Privacy and security

What we read

• Your reports from every platform you connect: royalties or sales, units, KENP pages, book titles, identifiers, covers.
• Your ad data from the ad accounts you connect, such as Amazon Ads and Meta Ads: spend, clicks, impressions, attributed sales.
• The Amazon reviews and sales ranks of your own books.
• If you create smart links, the clicks on them — see below.

That is all: nothing else is collected from the platforms you connect.

What we never see

• Your password. Connecting KDP or Kobo opens Amazon's or Kobo's own sign-in page — you type your password there, never into the extension or into TrueRoyalties, and neither ever sees, stores or transmits it. What we capture afterward is the session that sign-in creates, not the password itself.
• Your bank details. Amazon does not expose them, and payments to us are handled by Stripe.
• Who your readers are. Amazon discloses no customer identity, so we have none: no name, no email address, no Amazon account, and nothing they bought. The one exception is the technical, non-identifying record of a smart-link click, described next.

What a smart link records

This is the only place where TrueRoyalties handles data about your readers rather than about you — and only if you create a smart link.

For each click we keep: the date and time, a country code, a device category (mobile, tablet or desktop), the domain the visitor came from (never the full page address), which Amazon storefront we sent them to, and whether the request came from an automated client such as a social network building a link preview.

What we do not do:

• We do not store the visitor's IP address. To tell a repeat visit from a new one on the same day we keep a one-way hash that changes every day and cannot be turned back into an address.
• Following a smart link sets no cookie. Those links are served from a separate domain that carries none of our session cookies.
• Individual click records are deleted after 90 days. The daily totals behind your charts stay.

Read-only, always

TrueRoyalties never writes to Amazon. It cannot change a price, edit a campaign, adjust a bid, publish, unpublish or delete anything. There is no code path that does.

What the extension can access

By default it works on the pages the job needs: Amazon (KDP and storefronts, for reviews and covers), Kobo Writing Life, Draft2Digital, TrueRoyalties itself, and the sign-in page of each platform you choose to connect through it. It has no access to your other tabs, your browsing history or your bookmarks.

One optional exception. If you add a verified link to your verified page and the page is built with JavaScript — Wix, Squarespace, X, Instagram, TikTok — our servers receive an empty shell and cannot see your token. The extension can open that page for you instead, which requires a broader "read pages you visit" permission.

That permission is optional and asked once, with a button you press yourself. Decline it and everything else keeps working; only the verification of JavaScript-built pages stops. The extension opens the page you named, reads the text it rendered, and sends back only what is needed to confirm the token.

Where your data lives

Your imported data is stored in your TrueRoyalties account on our infrastructure, encrypted in transit. Amazon Ads credentials are stored encrypted.

Your public pages are opt-in

Nothing about you is public unless you make it so. Your verified page stays private until you publish it, you decide which figures appear and how precisely, and listing yourself in the public directory is a separate switch.

Deleting everything

Settings → Account → Delete account erases your data permanently and releases the link to your KDP account. There is no soft-delete and no hidden copy.

Simply cancelling your subscription does not delete anything — your history stays available if you come back.

Full policy

The complete legal text is in our Privacy Policy and Terms of Service.