Privacy policy

• Kart AI does not sell personal information.
• Kart AI does not send marketing email — it does not send any email at all right now.
• Kart AI does not accept payments, so it never sees payment card details.
• Two cookies: one keeps you signed in, one remembers light or dark mode.
• Ask and your account is deleted — in one step, not on a timer. Your comments stay in their threads with no name on them.

Creating an account collects an email address, a username, and a password. Passwords are never stored as plain text — only a one-way hash of the password is kept, so Kart AI itself cannot read it back. Anything you post while signed in — comments, submitted deals, replies, saved alerts — is stored tied to your account. Comments and submitted deals are public by design; saved alerts are private to you.

When you click a “Get deal” button or an offer link, Kart AI logs that click — which deal or offer, the destination link, and your account if you are signed in (clicks from signed-out visitors are logged without an account attached). This is how heat ranking counts outbound interest, and how commission would be attributed if a retailer purchase follows. Standard web server information (IP address, browser user agent, timestamps) is kept for operating and securing the site. Kart AI itself also writes two short-lived counters keyed by IP address — one limiting how often the compare tool can be started, one slowing down repeated failed sign-ins. Both are described under “How your information is protected” below, with how long they last.

Kart AI runs a bot in its own Discord server. Every fifteen minutes it reads the recent messages in the deal-submission channel and picks out the web links in them, so a link you post there becomes a deal suggestion. If Kart AI's automated checks pass, that suggestion can be written up and published on the site automatically, without a person reading it. Nothing else in the channel is read for any other purpose, and no other channel is read at all. The bot adds a ✅ or 🚫 reaction to say what it did with each message, and replies in the channel when it could not use a link — those marks and replies are visible to everyone in the channel, which is deliberate: it is how you can see what happened to your own post.

What is kept. The link itself, and a link back to the Discord message it came from, are stored with the suggestion so an editor can see where it came from. Your Discord account id is not stored. The only account id Kart AI keeps is the site owner's own, and only because the site has to be able to show afterwards which machine publishes were his. Nobody else's id is written down — not a name, not a handle, not an email, not the opaque numeric id either. Your Discord username is not stored, and nothing you post there is connected to a Kart AI account.

How long. The link and the message link are kept for as long as the suggestion is kept. A suggestion that becomes a published deal keeps them for as long as that deal is on the site; one an editor passes on is kept as a record that the link was already considered, so the same link does not come back round every fifteen minutes. If you want a message of yours taken out of that record, email the address at the bottom of this page and say which link it was.

Kart AI sets exactly two cookies: kart_session, an HTTP-only cookie that keeps you signed in, and kart_theme, which remembers your light or dark mode choice. Neither is used for advertising or cross-site tracking. Kart AI does not load any third-party analytics or advertising cookies while display ads are turned off, which is the default. If real ad serving is ever turned on, the ad network's own cookies would apply, and this page would be updated to say so.

• To operate core features: accounts, voting, comments, alerts, and the compare tool.
• To rank deals by heat, which counts outbound clicks alongside votes and comments.
• To detect and limit abuse of the site (for example, rate-limiting the compare tool).
• To attribute purchases when an affiliate relationship is configured for a link.

Kart AI does not sell personal information. When a link is an affiliate link, the retailer or affiliate network only sees the click itself arriving through their normal referral mechanism — Kart AI does not separately hand over your account details as part of that. Information may be shared with the infrastructure providers Kart AI runs on (for example hosting), solely to operate the site.

When retailer price lookups are switched on, comparing a cart sends the name of each item, and its product code (UPC) where the page published one, to those retailers' product APIs — Amazon, Best Buy, eBay, Walmart, and Impact for Target — so they can quote a price for it. They receive the item; they do not receive your name, your email address, or your account. The same is true of an item the browser extension read from a cart page. With the price providers switched off, which is the default, nothing about a comparison leaves the server at all.

The extension reads a shopping-cart page only when you click its button, and only on the page you are looking at. What it sends to Kart AI: the item names, quantities, and prices it read, a product code (UPC) for any item whose page published one, which retailer the cart is at, and the extension's own version number — or, if you choose “Send page text”, the visible text of that cart page instead of the item list. What it never touches: your passwords, payment details, browsing history, other tabs, or anything on any other page. It does not send the address of the page you are on. The extension sets no cookies, runs no analytics, and does not identify you — comparisons it creates are not tied to a Kart AI account. Each comparison is stored so its share link keeps working; contact us and we will delete one on request.

While your account exists, Kart AI keeps what you gave it and what you did with it: your email address, username, and password hash; the comments, deals, and replies you posted; your alerts and your saved deals; and the click rows described above. A sign-in lasts 30 days and renews while you keep using the site — signing out deletes that session there and then.

You can ask for your account to be deleted at any time by emailing privacy@kartai.net. There is no delete button inside the account yet, so a person reads the request and runs the deletion: send it from the address on the account, or tell us the username, and you will get a reply confirming it is done.

It is one step, not a schedule. There is no queue and no 30-day clock — when the deletion runs, all of this happens at once, and none of it is reversible:

• Every session is destroyed and the password stops working, so the account cannot be signed into again.
• The email address and username are overwritten with a placeholder that names nobody. They cannot be blanked outright — the database requires both columns to hold a value, and to hold a different one from every other account — so they are replaced rather than emptied.
• The password hash is replaced with a random value nobody knows, so there is nothing left to crack.
• Your alerts and your saved deals are deleted outright. Nothing else refers to them.
• Any comparison you ran while signed in stops pointing at the account. The comparison itself stays, because someone may be holding its share link — but there is no longer a name on it.
• A stub record stays behind, holding nothing personal, because your comments and posted deals hang from it.

Comments are anonymized rather than removed. Deleting a comment in the middle of a thread orphans every reply underneath it, so Kart AI keeps the text and drops the name: your comments and the deals you posted stay where they are, credited to “deleted user”. If a particular comment should come down as well, say so in the same email and it comes down. Your votes and click rows stay as well, still pointing at that stub — it names nobody, and leaving them is what stops a deal's heat or comment count moving because somebody left.

Takedown records are kept indefinitely. When a picture comes off the site because the person who owns it asked, Kart AI keeps a row saying that it happened, when, and which administrator did it — so that the removal can be evidenced later. Those rows hold no copy of what anybody sent, and no email address: the address the picture was at is stored as a fingerprint rather than as an address, and the one thing an administrator types is a short reference — a ticket number or a date — which the site restricts to a single word of letters, numbers, dots, dashes and underscores. That restriction rules out an email address, a full name and any part of the message itself; administrators are told to use a ticket number or the date and not to type anybody's name.

Backups are the one part of this Kart AI does not control. The live database is changed the moment the deletion runs; copies inside the hosting provider's own backup window age out on that provider's schedule, and Kart AI cannot reach into them to remove a single row. Nothing is restored from a backup as a matter of routine.

Cart comparisons work differently, because a comparison is a shareable permalink and people hold those links: a comparison is kept for as long as its link is meant to work, it is not on the 30-day clock, and nothing sweeps comparisons automatically today. One you ran while signed in is linked to your account, and that link goes with the rest of your data when the account does. One the browser extension made was never linked to an account at all, so there is no name on it to remove. Either way the promise in the extension section above holds exactly as written: send the share link to the same address and that comparison is deleted.

Server request logs — IP address, browser user agent, timestamps — are produced by the hosting platform rather than written by Kart AI, and they are kept for as long as the host keeps them. Kart AI does not currently set a shorter window of its own.

The two abuse counters Kart AI does write itself are the shortest-lived thing in the database. A compare rate-limit row is finished a minute after the window it counts and is deleted about five minutes later; a failed-sign-in row is forgotten fifteen minutes after the last failure. Neither is ever read for any purpose other than deciding whether to allow the next request, neither is attached to your account, and neither survives into a backup for longer than the backup itself. The sweep that removes them runs periodically rather than to a timer, so treat those figures as the shape of the retention rather than a guarantee to the second.

Kart AI is a US site and does not run a formal GDPR or CCPA compliance programme; saying otherwise would be a claim rather than a fact. The windows above were chosen to sit inside the ones those laws work to — a month under GDPR, 45 days under CCPA — so a request from someone either covers is handled on the same timetable as everyone else's.

Kart AI is run from New York, so the New York SHIELD Act applies to it from the first New York resident who signs up — that law has no revenue or headcount threshold. It asks for reasonable administrative, technical, and physical safeguards, and for notice if private information is exposed. Here is what Kart AI actually does, rather than a programme it would like to have.

• Technical. Passwords are kept only as a one-way bcrypt hash. Signing in sets an opaque random token in an HTTP-only cookie, marked secure in production so a browser only sends it over HTTPS, and the production site is served over HTTPS throughout. Kart AI takes no payments, so no card details ever arrive, and it never asks for a Social Security number, a government ID number, or anything biometric. The one thing here the act counts as private information is your email address together with the password that opens the account — and that password is only ever stored hashed.
• Addresses, and the short-lived counters that use them. Nothing Kart AI keeps about what you looked at or clicked carries an address: a click row holds the deal, the destination, the time, and the account if you were signed in, and no IP address. Two abuse counters are the exception, and they are written to the database rather than held in memory. The first counts requests to the compare tool over a one-minute window, keyed by address. The second counts failed sign-in attempts, keyed by address and by the email address that was tried, so that guessing at a password can be slowed down. Both rows are deleted once they stop meaning anything — a minute after the window they belong to, and fifteen minutes after the last failed sign-in — but the sweep runs periodically rather than on a timer, so a row can outlive its purpose by a few minutes. This says so rather than promising a stopwatch.
• Why those two are stored and not held in memory. Kart AI runs on hosting that answers requests from whichever server instance is free, and starts new ones under load. A counter kept in one instance's memory would be invisible to the others, so a limit of ten requests a minute would not be ten, and a sign-in lockout could be walked around by trying again until a different instance answered. Making these counters work at all means the instances have to share them, and the database is where they are shared. The trade is a small amount of data about you being written down briefly, in exchange for the protection being real; it seemed the wrong thing to describe as private-by-design while it quietly did nothing.
• Administrative. Kart AI is a one-person operation. The person who runs Seenly AI LLC decides how it is secured and holds the production credentials. There is no security team, no third-party audit, no certification, and no written information security programme. The act scales what it asks to a business's size and complexity, and this is the size Kart AI is.
• Physical. Kart AI holds nothing on paper and has no premises of its own where data sits. The application and its database run on hosting providers, in their data centres, under their physical controls.

If private information here were exposed, the act requires telling the people affected without unreasonable delay, and telling the New York Attorney General, the Department of State, and the State Police — plus the consumer reporting agencies if more than 5,000 New Yorkers are affected at once. That is the commitment: you hear about it, and those notices go out.

No site is perfectly safe and Kart AI does not claim to be. What it can say plainly is that the most sensitive thing a shopping site usually holds — your payment details — is not here at all.

Kart AI does not respond to Do Not Track signals, because there is no tracking here to switch off. It sets the two cookies described above and no others, loads no third-party analytics or advertising script while display ads are off, and allows no third party to collect information about your activity across other sites through Kart AI. If display ads are ever turned on that changes, and this page changes with it. Clicking an outbound link takes you to a retailer, and what that retailer does on its own site is governed by its own policy.

You must be at least 18 to have a Kart AI account — the terms of service say so, and the signup form asks. Kart AI is not directed at children and does not knowingly collect personal information from anyone under 13. If we learn that an account belongs to someone under the minimum age, the account and anything posted from it are deleted; write to the address below and it will be done.

This page may be updated as Kart AI's features change. Material changes will update the “Last updated” date above.

Privacy questions, account deletion, and requests to remove a comparison all go to privacy@kartai.net. It is a role alias that forwards to the person who runs Kart AI, and it is the address the extension section above means by “contact us”. Seenly AI LLC is the company behind it.