What the Birch Registry extension does — and doesn't — collect.

This policy covers the Birch Registry browser extension for Chrome and Edge. The extension lets a signed-in Birch customer add products from any retailer's website to their Birch baby registry with one click.

The storefront at birchstore.com is governed by our main Birch privacy policy. This document covers only what the extension does on your device and which signals it sends back to Birch.

By installing or using the extension you agree to the practices described here.

When you sign in: we receive your Birch customer ID, email address, and first / last name from Shopify's Customer Account API. We store an OAuth access token and a refresh token in the extension's sandboxed local storage so you stay signed in across sessions.

When you click "Add to Birch Registry" on a product page: the extension reads the current page's product metadata — title, image URL, price, description, retailer hostname, and any GTIN / MPN / brand fields embedded in the page's Open Graph tags or JSON-LD schema. That metadata is sent to Birch so the item can be added to your registry.

What we do not collect: we do not read or transmit your browsing history, page contents from sites you don't act on, form data, login credentials for other sites, analytics signals, cookies from third-party sites, or any data from pages where you don't explicitly click the "Add to Birch Registry" button.

The extension never runs in the background tracking you. It only acts when you sign in, when you click the button, or when you open the extension popup.

We use the data collected by the extension for one purpose: adding items to your Birch registry. Specifically:

• Your OAuth tokens authenticate API calls to Birch as you.
• Your customer ID resolves the correct registry to add items to.
• Product metadata (title, image, price, etc.) populates the registry item record.
• Your email + name appear in your registry editor so you know which account you're using.

We do not use extension data to profile you, build advertising audiences, or train machine-learning models. We do not sell extension data.

The extension talks to three services, all of which we control or contract with:

• Shopify (shopify.com) — verifies your identity at sign-in via the Customer Account API. Shopify's privacy notice applies to authentication.
• Birch's Cloudflare Worker — receives add-to-registry requests, validates your token, and writes the item to your registry in our Cloudflare D1 database (also in our infrastructure).
• Birch's AWS Lambda scraper — when the metadata the extension extracted on-page is incomplete, the Worker forwards the product URL to our scraper to fetch a richer page render. The scraper sees only the public product URL you chose to add. No tokens or personal data are sent.

We do not share extension data with advertisers, data brokers, or any third party not listed above.

On your device: the OAuth access + refresh tokens and a cache of your registry name live in the extension's chrome.storage.local — a per-extension sandbox that other websites and other extensions cannot read. It's encrypted at rest by your operating system. Clearing or signing out from the extension wipes it; uninstalling the extension wipes it entirely.

On Birch's servers: registry items you add (title, image, price, URL, retailer, plus your customer ID) are stored on Cloudflare D1 alongside the rest of your Birch registry. They live there until you remove them from your registry, end your registry, or delete your Birch account.

Token cache: we cache the mapping of access-token-to-customer-ID in Cloudflare KV for up to 5 minutes so we don't have to re-validate every API call. Cache entries expire automatically.

You can:

• Sign out from the extension popup at any time. This removes your tokens from the extension. Items already added to your registry stay in your registry — manage them at birchstore.com/pages/registry-edit.
• Uninstall the extension from chrome://extensions. All extension-side data is deleted by Chrome.
• Revoke OAuth access at Shopify by visiting your customer account and removing the "Birch Registry Extension" application from your authorized apps list.
• Delete registry items directly in the registry editor.
• Request deletion of your entire Birch account (which removes registries, items, and any extension-attributed records) by emailing support@birchstore.com.

If you are in the EU, UK, or California, you have additional rights under GDPR / CCPA — see our main privacy policy for how to exercise them.

Each permission has a specific, narrow purpose:

• storage — persist your OAuth tokens and the cached name of your active registry so the extension remembers you between sessions.
• identity — open the Shopify-hosted Customer Account API sign-in window using chrome.identity.launchWebAuthFlow. Required to authenticate you.
• activeTab — read the URL and product metadata of the tab you're on, only when you click the "Add to Birch Registry" button or open the popup. No background tab access.
• Host permission for birchstore.com and the Birch Worker — make authenticated API calls to Birch and let you open the registry-create page in a tab.
• Content script match <all_urls> — the "Add to Birch Registry" button is injected via a content script that runs on retailer pages so it can detect product metadata via JSON-LD / Open Graph tags. The script does nothing on pages without product data, and it never sends anything to Birch unless you explicitly click the button. Birch does not request the broader <all_urls> host permission, so the content script cannot make cross-origin requests on your behalf without an explicit action from you.

The extension is meant for adults (typically expecting parents) building baby registries. It is not directed at children under 13, and we do not knowingly collect data from anyone under 13. If a child has signed in, contact support@birchstore.com and we will delete the associated data.

If we change how the extension handles data, we'll update this page and bump the "Last updated" date in the hero. Material changes (new third-party recipient, new data category, narrower or broader use) will also be announced via an in-extension notice the next time you open the popup.

Privacy questions about the extension: support@birchstore.com.

For account, registry, or general Birch questions, see the contact page.