Privacy Policy

Effective 2026-04-30

What we collect

Stored locally by default. While you're on walmart.com, the extension:

• Reads the Walmart product page you're viewing — the same HTML and JSON Walmart sends to your browser — to extract the product ID, current price, your current pickup store, and the postal code Walmart is already using to render the page.
• Reads your Walmart cart, checkout, and /my-items page contents by observing the GraphQL responses Walmart sends to your browser. This is what lets the extension compute per-item and total savings.
• Reads a small set of non-HttpOnly Walmart cookies that any script running on the page can already see: assortmentStoreId (to detect when you've switched stores in another tab) and presence-only checks for customer / CID / hasCID / type (to tell whether you're signed in). The extension does not request Chrome's cookies permission and cannot access HttpOnly cookies or cookies on any non-Walmart domain. Cookie values for the logged-in markers are never inspected — only their presence.
• Looks up nearby stores by calling Walmart's own nearByNodes GraphQL endpoint from the extension's service worker, using the postal code the page already provided. This is the same query Walmart's own store-picker uses.

What we do not collect

• We do not run background telemetry or analytics.
• We do not automatically send your shopping history, cart contents, prices viewed, or any personal data to our servers or any third party.
• If you click Send debug report in the popup, StoreSwitch sends a sanitized support report to 0th Canvas so we can troubleshoot bugs. It contains extension version, coarse browser metadata, disabled/config source, aggregate counters, and recent diagnostic reasons/counts. It excludes cookies, headers, raw URLs, addresses, product names, cart contents, and response bodies.
• We do not set tracking cookies. We do not request Chrome's cookies permission.
• We do not read pages on any site other than walmart.com.
• We do not use analytics services, heat-maps, or session recorders.
• We do not load remote code (no eval, no remote scripts).

What we store on your device

The extension keeps the following in chrome.storage.local. Stored locally by default.

• A counter of feature usage (how many product pages were checked, how many switches succeeded, total dollars saved). This is what powers the popup summary.
• A short-lived cache of recent cart and product-page price comparisons, so the extension doesn't re-probe nearby stores on every reload.
• A short-lived /my-items scan cache (~30 minutes) that holds, per nearby store, the rows the extension just computed: each row carries the saved item's Walmart usItemId, its display name, baseline and target prices, the savings amount, and the thumbnail URL Walmart already served on the page. This avoids re-running a 5-store probe batch every time you navigate back to /my-items.
• Pending and attested switches: per switch, the extension records the items, your origin and target Walmart store IDs, the per-unit price you would have paid (baseline) and the per-unit price you actually paid at checkout (realized), the quantity, the seller class (Walmart 1P vs marketplace), and the fulfillment mode (pickup / delivery / shipping). The order grand total is recorded once per checkout. When per-line realized data is available, the popup's "you saved $X" number is computed from it rather than from the click-time projection; when realized data is missing (rare parser drift or legacy entries) the popup falls back to the projected amount.
• Configuration the extension fetched from a public configuration URL (used as a kill switch if Walmart's backend changes). Contains no user data.
• A local diagnostic log of recent StoreSwitch outcomes: reasons/counts only, excluding cookies, headers, raw URLs, addresses, product names, cart contents, and response bodies. Used only when you click Send debug report.
• A first-run flag, per-product dismissal timestamps, and a single boolean (newsletterCtaDismissed.v1) so the optional newsletter CTA doesn't nag once dismissed.

You can clear all of this at any time by removing the extension or by clearing the extension's storage in chrome://extensions.

Local telemetry

The extension keeps a small event log in chrome.storage.local. You can see these counters by clicking the extension icon. Events recorded:

• Install.
• Visits to Walmart product pages (with the product identifier).
• Probe completions, card shows, dismiss clicks, switch clicks.
• Successful store-switch commits — with the origin store, target store, projected per-item baseline price (cents), quantity, fulfillment mode, and seller class so the popup can later compare projected to realized.
• Per-line attestations on the /thankyou page after a checkout — adding the realized per-unit price (cents) actually paid.
• Per checkout: the order grand total (cents) and the count of pending switches dropped because their items did not appear in the placed order.

Stored locally by default. They're rendered in the popup so you can see what the extension has done. A sanitized support report is sent to 0th Canvas only when you click Send debug report. Debug reports are used only to troubleshoot bugs and are retained for up to 30 days.

Permissions

• host_permissions: *.walmart.com — to read prices and detect cart contents on Walmart pages, and to call Walmart's price and store-lookup endpoints.
• host_permissions: storeswitch.0thcanvas.com — only when you click Send debug report, to submit the sanitized support report described above.
• storage — to keep the local usage counter, the short-lived caches described above, and the kill-switch configuration.

The extension does not request any other permissions. In particular, it does not request Chrome's cookies, scripting, tabs, or activeTab permissions.

Newsletter (optional)

After install, the welcome page and a one-time popup offer an optional weekly Walmart deals digest. Subscribing is strictly opt-in and happens via a Beehiiv hosted form that opens in a new tab. The extension itself does not collect or transmit your email address — the form is on Beehiiv's domain and you choose whether to submit it there.

If you do subscribe:

• Beehiiv (data processor) collects your email and standard newsletter delivery metrics (opens, clicks). Their privacy policy applies: https://www.beehiiv.com/privacy.
• We send at most one short email per week with the best price drops we've spotted across nearby Walmart stores.
• You can unsubscribe with one click from any email.

If you do not subscribe, nothing changes — no email is collected, no signup is recorded, and the popup CTA can be dismissed permanently. The CTA records a single boolean (newsletterCtaDismissed.v1) in local extension storage so it doesn't nag.

We do not store an email address inside the extension under any circumstance, and we do not sell, share, or repurpose subscribers' email addresses.

Your controls

• Uninstall the extension from chrome://extensions at any time. Uninstalling removes all local storage.
• Dismiss a card to suppress it for 24 hours.

Contact

Questions? Email support@0thcanvas.com.

Changes

If we materially change this policy we will publish a new version at the same URL and bump the effective date.