Last updated: July 14, 2026
Short version: Almost everything OpenShip does runs entirely in your browser. A few
narrow features reach our server, and every one is anonymous and aggregate — no account, no
per-user identifier, nothing that ties an action to you. Most are opt-in (a button, or a
setting that's off by default): "Save this store," "Add QC photos," and "Resolve
shortened/wrapped links." One is on by default: an anonymous "popular items" counter —
when you open an item on your agent, an anonymous +1 is added to a public tally so
the popular-items board reflects what the community is buying. It sends only the item (platform,
id, title) and which agent, never anything about you, is disclosed at first-run, and a single
toggle turns it fully off. Beyond that anonymous tally, no link you convert, no agent you pick,
and no page you merely visit is ever sent to us. No tracking pixels, no ads, no accounts, no
per-user identifiers of any kind.
OpenShip stores the following in your browser's local extension storage
(chrome.storage.local) — this data never leaves your device:
Link conversion — none, by default. Converting a link is pure string manipulation done entirely in your browser; no network request is made to build or convert a link. The one exception is the opt-in "Resolve shortened/wrapped links" setting (off by default) — see below.
Resolving shortened/wrapped links — off by default, asked about once during first-run setup and changeable any time from the options page. Some links (commonly on Yupoo) wrap or shorten an agent link — sometimes carrying someone else's referral code — behind a redirect. With this on, your browser asks that redirect service where it points, the same request your browser would make if you clicked the link yourself — nothing about you is sent beyond that. With it off, those specific links just don't convert; everything else in the extension behaves identically either way.
QC photos — when you open the QC tab for an item, your browser sends the item's platform and ID to acbuy.com's public photo-lookup API, and to our own community catalog (see below) as a fallback. No personal data is included — just which product you're looking at. On a Sugargoo product page specifically, its own "photos of recent purchases" section is read directly off the page you're already viewing — no request of any kind is made for that.
Save this store — the one feature that talks to a server we operate. Clicking
it sends the store's URL (with any referral/tracking parameters stripped first) to our
API at openship.vercel.app/api/save-store, which increments a counter for
that URL in our database. That's the entire payload — no cookie, browser fingerprint,
IP-derived identifier, account, or install ID is sent or stored alongside it. The
database can tell you "this store was saved N times"; it cannot tell you by whom, and
is designed so that it structurally can't — there's no column for it. This powers the
popular stores board, and it only fires when you press the
button.
One special case: some sellers have no marketplace listing and only take orders directly (WhatsApp / Discord / WeChat), posting those contact details publicly on their Yupoo album. When you save one of those, the publicly-posted contact string is saved alongside the store — so it appears on the popular-stores board as the only way to actually reach that seller. It's read straight off the public album you're viewing; still no identifier of you is attached.
Popular items — the one feature that talks to our server automatically,
and the only one that's on by default. When you open an item on your agent (click
through to buy it), an anonymous +1 is sent to
openship.vercel.app/api/items so the popular items
board can reflect what the community is buying. The entire payload is the item's
platform, its id, its title, and which agent — no cookie, IP-derived identifier, account,
install id, or anything that could tie a count to you. Like the store counter, the database
is built so it structurally cannot say who converted an item, only how many
times it was. It is genuinely anonymous, but because it's automatic we call it out
plainly here: it's on by default, disclosed during first-run setup, and a single
toggle on the options page turns it fully off — when off, converting an item makes
zero network calls, exactly as before.
Seller Yupoo links — the other on-by-default, anonymous community
contribution (the same settings toggle turns both this and popular items off).
When you're on a seller's Yupoo album, the extension reads the "camouflaged" marketplace
link(s) the seller embedded and remembers on your device which album sells which
item — so when you later open that item on an agent (where the listing is often a decoy
with no real photos), it can point you straight back to the Yupoo. If the community-data
setting is on, that same album↔item pairing is also sent to
openship.vercel.app/api/yupoo so other people on that item benefit too. The
entire payload is the item (platform, id), the Yupoo album URL, and its title —
no identifier of you, and nothing about which albums you browse beyond the single
pairing you contribute. Only genuine yupoo.com URLs are ever accepted or stored.
Add QC photos — a feature that talks to a server we operate. If you
choose to submit a photo from the QC tab, the image file, the platform, and the item ID
are sent to openship.vercel.app/api/qc-upload and stored — nothing else is
attached, no account or identifier of any kind. Submitted photos are not public
immediately: they sit in a private review queue only the maintainer can see, and
only become visible to other users (via /api/qc-photos) after manual
approval. Don't submit a photo containing personal information (yourself, your address
label, etc.) — anything you submit and gets approved is visible to every user of the
extension.
The QC photo lookup is a public, unauthenticated third-party API — that goes directly from your browser to the named third party, we're not in the loop. The store-save counter, the popular-items counter, the seller-Yupoo map, and QC-photo submission above are the only network calls that reach infrastructure we operate — and every one of them is anonymous and aggregate, with no identifier of you attached.
OpenShip's core feature is converting marketplace and shopping-agent links wherever you find them — Reddit threads, spreadsheets, Discord, any page. That requires the browser permission to run on all sites. The extension only reads link URLs on the page to detect convertible ones, and only rewrites the specific links it converts. It does not read page content, form inputs, or anything else, and does not transmit page content anywhere.
Converted links carry the maintainer's referral code, disclosed in the extension's popup every time. No referral routing happens silently. You can also paste a signed creator code into the popup's "Support a creator" card to route a transparent share of your referrals to a creator you follow instead of the maintainer — see how creator splits work for the details.
The entire codebase, including every network call this policy describes, is readable source — nothing is minified or obfuscated. You're welcome to audit it yourself.
Questions about this policy: reach out via the extension's listing page.