Last updated 10 September 2026
Privacy
This describes what listWright actually stores, what leaves the server, and what it does not do. It is written so you can hold it up against the software and check, not so that it sounds reassuring.
What is collected
Your account. An email address, the shop name you chose, and your password stored as an argon2id hash. The password itself is never written down anywhere and cannot be recovered from what is kept. A forgotten password has to be replaced, not looked up.
What you upload. The rows of every spec sheet you submit are stored as the canonical record of each product, along with a fingerprint of each row. That fingerprint is what lets an unchanged product be skipped instead of regenerated, so the sheet contents are kept rather than read and discarded.
What is generated. Every version of the copy written for a product is kept, along with the run that produced it: title, description, tags and sku. Older versions are never overwritten.
Runs. When each batch was submitted, how many products it covered, how many credits it cost, which items failed and the rules they broke.
Sessions. When you log in, a record is stored holding your account, the expiry, and a SHA-256 of the session token. The token itself is not stored, so the records cannot be read to impersonate you.
Server logs. Requests are logged with a request identifier, the method and path, the response status, and the account and user the request acted as. These are ordinary operational logs.
A connected shop, if you connect one. Connecting is optional and starts switched off. If you do connect one we store the shop's identifier, its name, the permissions you granted, and the access and refresh tokens the marketplace issued. Those two tokens are encrypted before they are written down, with a key held in this server's configuration and not in the database, so a copy of the database on its own does not open them. We never receive, ask for, or store your marketplace password: you approve the connection on the marketplace's own site and it hands us a token instead.
What a connected shop means
There is a section for this on its own because it is the one part of this service that reaches outside it, and because you should be able to check the claim rather than take it.
Reading. Importing asks the marketplace for your active listings and stores each one as a product row here: the title, the description, the tags, the sku, the price, the quantity, the materials and the category. That is the same record an uploaded spreadsheet produces, and it is kept and deleted on the same terms as everything else on this page. No photograph is fetched, looked at or stored. Neither is anything about your orders, your customers or your money, because the permission to read those is never asked for.
Writing. Publishing sends three things to the marketplace: a title, a description and a set of tags. Nothing else is sent and nothing else is changed. It happens when you press publish on one product, never on a schedule and never in bulk behind your back. A product that is not already a listing in your shop is created as a draft, so it is not on sale until you publish it there yourself.
Ending it. Disconnect a shop and the stored tokens are deleted immediately. Nothing is left on this side that could reach it again. You can also revoke the access from the marketplace's own account settings, and that works whether or not you tell us. Deleting your account takes the connection with it, along with everything else.
What leaves this server
Generating listing copy can involve sending the contents of a product's row to Anthropic's API, which is the model that writes it. It is sent as text with no tools and no access to anything else, and it carries no account details, no email address and no password. Just the product row and the instructions for writing a listing.
The other place data leaves this server is a marketplace you have connected, and only in the two directions described above: reading your listings when you import, and sending a title, a description and tags when you press publish. With no shop connected, that never happens.
An instance can instead be run with a deterministic generator that builds the copy from your fields on this server, in which case nothing is sent anywhere. If it matters to you which one this instance uses, ask whoever operates it.
There is no analytics service, no advertising, no error-reporting service and no embedded fonts. The scripts this site runs are served from here and not from a content network, specifically so that loading a page does not tell somebody else who is reading it.
One exception, on two forms. The demo on the home page and the sign-up form each load a bot check from Cloudflare, which sees your IP address and enough about your browser to judge whether you are a person. It is not used to identify you afterwards, and no other page loads it. Those two carry it because they are what a stranger can set running without an account: one writes a listing and sends an email, the other opens an account with free credits on it. Both cost us money, and a script can ask for either over and over.
Cookies
Four, all HttpOnly and SameSite=Lax, and none of
them used to track you across sites or to build a profile of you.
| Cookie | Holds | Lasts |
|---|---|---|
| lw_session | An opaque identifier for a login held on the server. Not a credential on its own. | Until the session expires, or you log out |
| lw_form | A token the login and signup forms echo back, so another site cannot post them on your behalf. | 30 minutes |
| lw_last_run | The identifier of the last run you started, so the dashboard can link back to it. | 7 days |
| lw_src | A short label naming the advertisement you arrived from, when you arrived from one, so we can count how many accounts a campaign produced. It holds nothing about you, only which link was clicked, and it is deleted the moment an account is created. | 30 days, or until you sign up |
lw_src is the one that deserves a sentence of its own, since
it exists because we buy advertising. It is written by this server, read
by this server, and never sent anywhere. There is no advertising pixel on
this site and no third-party script that could see it, which is the whole
reason it works this way: the alternative is the ad network watching you
read, and counting our own signups is not worth that.
Because none of these follow you to other sites or build a profile, there is no consent banner to click through.
Who can see your data
Every record carries the account it belongs to, and every query is restricted to that account. Ask for another account's product or run and you do not get a filtered result. You get nothing at all, and it reads as though the thing was never there. Signing up creates an account of its own; it gives you access to nothing that already existed.
Whoever operates this instance has access to the database and can read what is in it. That is unavoidable for anyone running a service on their own infrastructure, and it is stated here rather than left implied.
How long it is kept
Products, runs and generated copy are kept until they are deleted. Sessions stop working at their expiry and are cleared out afterwards; a revoked session stops working immediately. A shop connection is kept until you disconnect it. An authorisation you started and did not finish is deleted within half an hour.
You can delete your account yourself, from the account page. It removes everything belonging to it, and it happens immediately: products, runs, generated copy, API keys, shop connections and sessions all go together. There is no grace period and nothing kept back to restore from, so it cannot be undone. A paid subscription is cancelled as part of it.
One record outlives the account, deliberately: which payment events have already been processed, kept without the account it belonged to. It holds no personal data, and it is what stops a payment notification arriving afterwards from being acted on a second time.
Asking about your data
Requests for a copy of your data, a correction, or a deletion go to [email protected].
Depending on where you and the operator are, you may have rights over this data under local law that go beyond what is described here.
Changes
The date at the top is when this was last changed. It describes how the software behaves as of that date; if the behaviour changes, this should change with it.