Legal

Privacy policy

Last updated: October 5, 2026

ParcelFill is a Chrome extension that helps you fill ShipStation customs forms, catch label mistakes and move orders between Yami, ShipStation and Chit Chats. This policy explains what data the extension and our license server handle. It is operated by SortaHub Inc., a company incorporated in Canada ("we").

The short version

• The extension does its work locally, inside your browser.
• Your orders, your customers' names, addresses and phone numbers, and your API credentials are never sent to us.
• Our license server only receives what it needs to check your license and keep your saved settings — which never include an order, a customer or an API key.
• We do not sell data, show ads, or use analytics or tracking scripts.

Data that stays in your browser

To fill forms and run migrations, the extension reads order and shipping details from the ShipStation, Yami and Chit Chats pages you have open. That data, and any API keys you enter for API mode, is processed and stored only in your browser (Chrome's extension storage; API credentials are encrypted there). When you use API mode, the extension talks directly to the service you connected, such as ShipStation, Yami or Chit Chats, using your own credentials. Those requests never pass through our servers.

Data our license server receives

When you activate, refresh or deactivate a license, or save settings, the extension contacts our license server. It receives:

• Your license key. We store only a one-way hash of it, not the key itself.
• A random instance id. The extension generates it once per Chrome profile. It identifies that installation, not you or your device hardware.
• A description of each connected browser, so you can tell them apart on your account page: the browser and its version, the operating system and its version, the extension version, and how it was connected.
• Names you give a browser, if you type them: a name for the computer and who uses it. You can change or clear them on your account page.
• The Chrome profile's email address, only if the person connecting ticks the box for it and allows Chrome's own permission prompt. Without that it is never read.
• An approximate location of each connected browser — city, region and country, as our hosting provider (Cloudflare) reads it from the connection — shown on your account page. We do not store the IP address it comes from.
• Your IP address. It is used to limit abuse and is stored only as a salted hash per day, so we can notice a single key being used from many places. We do not store the IP address itself.
• The settings you save. Everything on the extension's settings page that follows your license between browsers: your item types with their HS codes and countries of origin, your declared-value limits, the price at which a label is queried, the shipping services you listed, whether the extension combines a Shopify shipment's rows, whether it remembers the parcels you have shipped and the rules it matches them by, your Chit Chats client number, your ShipStation store name and default carriers, how often an orders list refreshes, and the order defaults you chose (a customs contents type, what happens to an undeliverable parcel, whether the invoice number is the order number, an insurance choice, and who is billed duties and taxes), and which rows of the card's status view you pinned first.
• Manufacturer details, if you enter them. Chit Chats asks who made the goods on a shipment to the United States. If you fill that in, the business name and postal address you typed are saved with your settings so the extension can write them onto each shipment. They describe a supplier, not you, and they are stored exactly as you typed them. Leave them blank and nothing is stored.

We also keep the dates each activation was first and last seen, and the dates of deactivations.

Payments

Payments are handled by Stripe. We never see or store your card details. Stripe shares with us your email address, your customer and subscription ids, your plan and your subscription status, which we link to your license. You connect the extension by signing in with that email address. (Purchases made before October 2026 also have a license key printed on their Stripe invoices; newer ones do not.) Email is sent through Resend, which receives the recipient's address and the message (a sign-in code or a purchase confirmation).

Service status check

Every few minutes the extension downloads a small public file (status.json) from our website to check that the service is enabled. This request carries no license or order data. The file is hosted on GitHub Pages, so GitHub's servers see your IP address in their logs, as with any web request. That host carries that one file and nothing else — the rest of the site is served by Cloudflare.

Hosting

The license server and website run on Cloudflare Workers, and the license data is stored in Cloudflare D1. Cloudflare processes requests on our behalf. Our request logs, which can include IP addresses, are kept for a short time (30 days) for troubleshooting only.

How long we keep data

License, activation and settings records are kept while your license exists and for 12 months after it ends. Daily IP hashes are kept for 90 days. Payment records are kept as long as tax law requires.

Bug reports and enquiries

If you send a bug report or a question through the bug form or the contact form, we receive the address you typed, your message, and anything you wrote in the optional fields. We use it to answer you. Bug reports and enquiries, including the address, message and optional fields, are kept for 24 months and then deleted. The contact and bug-report forms use Cloudflare Turnstile to keep out automated submissions.

When you remove the extension, Chrome opens a short survey on our site. If you answer it, we receive the reason you pick, the optional message and email you add, and the extension version. We keep them for 24 months, like the other forms. The survey uses Cloudflare Turnstile too.

A screenshot of a shipping order usually shows a customer's name and address. Crop out anything you would rather not send. Screenshots you attach are stored privately in Cloudflare R2 and deleted after 60 days; the links in our notification email are signed and expire with them, so they cannot be opened by anyone who was not sent one, and they stop working when the file goes. We do not use them for anything other than the report they came with.

Your choices

• Deactivate an installation from the extension at any time. This deletes that activation record.
• Uninstalling the extension removes everything it stored in your browser.
• You can ask us for a copy of your data or ask us to delete it. Deleting it ends your license.

Chrome Web Store limited use

ParcelFill's use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the extension's features and is not transferred, sold or used for advertising.

Language

This policy is written in English, and translations are provided so you can read it in your own language. If a translation and the English differ, the English version governs — except where the law that applies to you says otherwise.

Changes

If this policy changes, we will update the date at the top of this page.

Contact

Questions or requests: contact us, or write to info@sortahub.com.