Security

Last updated November 13, 2026

GrailTrakr works with your marketplace and price service accounts, so we built it to need as little trust as possible. Your logins stay in your browser, the extension only reads, and your data is visible to your account alone.

The Chrome extension

The extension runs in your own Chrome, with the logins already in your browser. It opens marketplace searches and price service pages in a background window, reads the listing and sales details on those pages, and sends the results to your GrailTrakr account.

  • Read only. It never messages sellers, makes offers, clicks buy, posts or changes anything on your accounts.
  • Your logins never leave your browser. GrailTrakr never sees or stores your Facebook, GPA, GoCollect or other passwords, cookies or sessions.
  • Only the pages it opens. It does not read your browsing history, messages, friends, or any page it did not open for a search.
  • Only the sites it needs. It can reach facebook.com for Marketplace, comics.gpanalysis.com for sales data, and grailtrakr.com to save results. gocollect.com is optional: Chrome only lets the extension open it after you click Connect GoCollect and allow it, and Turn off removes that access.

What each Chrome permission is for:

  • Tabs opens and closes the background window used for searches.
  • Scripting reads listing and sales details from the pages the extension opened.
  • Storage keeps the connection to your account, your run time and the status of the last run.
  • Alarms starts the nightly search and the hourly search for flagged grails.
  • Notifications shows a summary when a run finishes.

eBay

eBay is searched by our servers through eBay's official Browse API, not by the extension, so it never touches your eBay account and needs no eBay login. The API keys live only on our servers. eBay receives the title and issue of your grails, never your name or email. As eBay requires, we answer its account deletion notices, and since we store no eBay user data there is nothing to delete.

Your account

  • No passwords. You sign in with a one-time code sent to your email, so there is no GrailTrakr password to steal or reuse.
  • Private by design. Every table in our database is locked so an account can only ever read its own rows.
  • Extension keys are hashed. When you connect the extension we create a private key and store only a scrambled copy. You can connect up to two of your own browsers, and reconnecting replaces the old key.
  • Admin access needs a second step with an authenticator app, checked on the server.

Your data

  • Encrypted in transit (HTTPS) and at rest.
  • Stored with Supabase in Oregon, United States, and hosted on Vercel. The full list of providers is in our Privacy Policy.
  • Never sold, and never used for advertising.
  • Deleted straight away when you delete your account in Settings. Provider backups expire on their normal schedule, typically within 30 days.

Report a security problem

If you think you have found a security issue in GrailTrakr, the website or the extension, please email security@grailtrakr.com with the steps to reproduce it. We will reply within 5 business days and keep you updated while we fix it.

Please test only against your own account, do not access or change anyone else's data, do not disrupt the service, and give us a reasonable chance to fix the issue before sharing it. If you follow these guidelines in good faith, we will not take action against you.