ESHArio Privacy Policy

Last updated: 8 November 2026. This page describes the ESHArio browser extension for Google Chrome, the eshario.com website and the purchase of a key.

Short version

ESHArio keeps your data on your own computer. What leaves it is only what the features need to work, and all of it is named on this page:

• When you press a button. Your email and password to our server when you sign in; your settings when you press "Save settings"; a problem report when you press "Send"; linking Telegram and price bells.
• By itself, after you sign in to an ESHArio account. The paid access check, your sales log, and with paid access also your settings, the card memory (locks, purchase prices and the like) and the extension's action counters, so that they are the same on all your computers.
• By itself, while the web app is open with paid access. A "running" message every few minutes, waiting for signals about cards and prices, and a usage summary that the extension updates during the day at most once every 10 minutes, while the server keeps one per day (see "Usage summary"; it can be switched off in the settings window).
• By itself, when a squad is worked out or the Gallery is open. The club cards and the calculation question go to our server in the European Union; the server answers and does not keep the club list (see "What is sent over the network", errand "Squad and Gallery calculation").
• By itself, on every copy. The card reference, the latest version number and ESHArio's code from our server; copies without paid access send a day mark once a day, with no email and no EA account.

If you link your Telegram yourself, the server keeps the numeric ID of your chat so it can write to you. The extension never sees your EA account password. ESHArio's code updates from our server and runs only when it is signed with the developer's key (see "Updates to ESHArio's code"). There is no advertising and no third-party analytics in the extension or on the site; on the purchase and order pages only the payment partner’s verification code runs. We do not sell your data and do not share it for anyone else's advertising. To run the service, some of the data is handled by our suppliers: the payment partner, hosting and a mail service. When you buy, we receive your email and the order details from the payment partner (see "The website and your purchase"). We occasionally email buyers about discounts; you can opt out with the link in any such email.

What ESHArio is

ESHArio is an extension for Google Chrome that adds tools inside the official EA SPORTS FC Web App at https://www.ea.com/*/ultimate-team/web-app*. The tools work on that address only. The extension's bridge sits on EA pages (https://*.ea.com/*): on other EA pages ESHArio's code checks the address and does nothing else, and no request is made from there. On our own website (https://*.eshario.com/* and the spare name https://*.eshario.app/*) a thin bridge tells the site that the extension is installed and which ESHArio account you are signed in to. On every other site the extension does nothing at all, unless you give it access yourself with a button in the ESHArio window (see "Permissions taken ahead of time").

Updates to ESHArio's code

The extension is installed from our website once. The code that works inside the Web App (the tools, windows and styles) comes from our server api.eshario.com and our website eshario.com and runs only if it is signed with the developer's key. The signing key is not on the server, so the code cannot be swapped even by someone who breaks into the server. Once an hour, when the Web App opens and when you come back to it, the extension asks the server whether a new version of the code is out. That question carries the extension's version number and, if you are signed in to an ESHArio account, the account number, so that a new version can reach part of the accounts first. The server counts how many copies asked by a fingerprint of the network address that cannot be turned back into the address, and keeps these counts for 90 days. The downloaded version and the previous one stay in your browser's storage on your computer, so the extension also works offline.

ESHArio is an independent product. It is not affiliated with, endorsed by, or sponsored by Electronic Arts Inc.

What is stored on your device

ESHArio uses Chrome's storage and unlimitedStorage permissions to keep its own data in your browser's local storage. The data consists of:

• Your settings. Which features are on, hotkey assignments, display choices, and which panels are open.
• Your saved filter sets. The market searches you chose to save.
• A local copy of your club list. Card identifiers, ratings and similar game attributes, so squads can be built without asking EA for the same list again. It holds nothing about you as a person.
• A purchase log. The price you paid for a card: EA discards that number itself. With paid access and a signed-in account, purchase prices travel to our server together with the card memory.
• Card memory. Card locks from squad building, freezes, picks made by hand for a challenge, "bought for the plan", the extension's book of deals, the "new sale" mark, the spend of a big challenge and "Caught" for template rows. With paid access and a signed-in account it travels to our server, so that your other computer has the same.
• Action counters. How many market searches, purchases and challenge submissions were made in the last hour and day; the extension keeps them for its own operation. With paid access and a signed-in account they travel to our server as numbers per 10 minutes, so that pauses and limits are counted across all your computers together.
• Reference data about game cards. A catalogue of card definitions and rarity groups: part of it is read from the Web App itself, part is downloaded from our server (see "What is sent over the network"). It holds nothing about you.
• The contents of a pack preview you have opened. The card identifiers from that preview, their quick-sell value and whether they can be traded, with no market prices. The record lives until EA changes what that preview holds, and it never travels to the server.
• A 7-day request log. When and which requests to EA the web app and the extension made, and what EA answered, which searches ran, what was bought and sold, the coin balance, 30-day totals, a snapshot of the 7 days before an EA decision on the account and a permanent account tag; it does not travel to the server by itself, except for a compressed log on the day of an EA decision on the account (see "Usage summary"). Records erase themselves after 7 days, totals after 30 days, and the snapshot stays until support or removing the extension deletes it.
• A licence key, if you entered one. It is signed, verified on your own machine, never sent anywhere, and says nothing about you.
• ESHArio's code. The current and the previous versions of the code that came from our server under signature, their settings and a log of update checks. It holds nothing about you.

Chrome stores it on the machine where the extension is installed. What of it travels to our server is said for each item and under "Moving your settings to another computer", "Accounts and paid access", "Usage summary" and "Problem reports".

Moving your settings to another computer

You can move your settings to another computer through your ESHArio account with two buttons. "Save settings" puts the settings of this computer on our server in place of the previous copy. "Load settings" replaces the settings of this computer with the copy from the server. The buttons are in the extension's settings window (the "Account and help" section) and on the account page. If the server holds a copy saved from another computer after your last one, "Save settings" tells you so first and replaces it only on a second press.

With paid access the settings also travel by themselves: while "Sync this computer" is on in the same section (it is on out of the box), a change goes to the server a few seconds later, and when the web app opens, a fresh copy from another computer arrives. Switch it off, and the settings of this computer travel only with the buttons.

What travels: feature toggles, saved filter sets, buying and selling settings, the listing and relisting price rules, how pack openings are shown, sound volume, squad builder settings, hotkeys, the pick preselection, pack locks and the "Usage summary" switch. Your EA login and password, the licence key, the local club mirror and the request log do not travel with the settings. The sales log, the card memory with purchase prices and the action counters travel their own way, without buttons (see "Accounts and paid access").

The copy lives in our database on a rented server in Germany, and only we have access to it. A spare copy of the database for the case of a failure lives on our second rented server in France. Both servers are in the European Union. The connection is encrypted (HTTPS); the settings themselves are not encrypted in the database, and neither is the account email. Seven daily backups of the database are kept on the same server. The settings copy is deleted together with the account at your request.

The extension no longer uses Chrome's own cloud for settings: it neither writes there nor reads from there. If you switched on the transfer through Chrome's cloud before, the old copy stays in your Google account until you remove the extension on every computer or clear its data in Chrome.

What is sent over the network

ESHArio may make network requests to exactly four third-party sites (six host patterns in the manifest): ea.com, fut.gg, futbin.com and futwiz.com. Today it only goes to the fut.gg price service (the r2.fut.gg and www.fut.gg hosts), and only to read public reference data: the shared market price file and the public list of Squad Building Challenges with community ratings. What leaves your computer is only a page number and the id of the challenge you opened. The requests go without cookies, and fut.gg does not know who asked. The permissions for ea.com, futbin.com and futwiz.com are taken ahead of time, so that new features do not require installing the extension again; when the extension starts going there, this page will say what is sent. All such requests go without cookies.

The other two patterns are not third parties at all: they are our own website and server (*.eshario.com) and their spare name (*.eshario.app), the same server under another domain in case the main one becomes unreachable. The extension contacts the api.eshario.com server on eight separate errands.

Your account. When you sign in yourself, ask to reset a password or press "Save settings" or "Load settings"; and while you are signed in it also asks that server from time to time whether your paid access is open: when the web app opens, when you come back to it and when you press "Refresh". While the web app is open with paid access, the page tells the server every few minutes that it is running. After you sign in, the extension also carries your sales log by itself, and with paid access your settings, the card memory and the action counters. What goes there is described under "Accounts and paid access".

A problem report. When you press "Send" yourself in the "Report a problem" window. What a report holds and what it never holds is described under "Problem reports".

The card reference. The extension downloads a card reference from our server: the rating, position, nation, league, club and rarity of the season's game cards. That is data about game cards only; nothing about you is sent there. The download happens on its own, a few times a day, and works without an account: the session token takes no part in that request, no cookies are set, and we do not record who downloaded the file.

The latest version number. A copy of the extension installed from our website without the store asks the server once an hour for the number of the latest version and the address of the download page, so it can tell you that a newer version is out. That request carries no session token, no cookies and nothing about you. A copy from the Chrome Web Store never makes it: the store itself keeps that copy up to date.

Code updates. The question about a new version of the code and the download of the code itself (see "Updates to ESHArio's code"). They carry no session token and no cookies.

Signals. While the web app is open with paid access, the extension waits for signals from the server; linking Telegram, signal settings and price bells go to the server when you press a button. What is sent and what the server keeps is described under "Signals and Telegram".

Usage summary. While the web app is open with paid access, a short summary of the day is updated during the day (at most once every 10 minutes, the server keeps one per day), and if the EA web app reported an EA decision on your account, a compressed log of the last 7 days goes once; copies without paid access send only a day mark once a day. What they hold and how to switch them off is described under "Usage summary".

Squad and Gallery calculation. Squads for SBC challenges, OneClick and series plans and the Gallery are worked out on our server, not in your browser. The calculation question carries the signed proof of your paid access, the challenge requirements, the club cards the calculation needs (card numbers, ratings and similar game attributes) and your Gallery marks (what is collected, who is the first owner, what has no answer yet). A server in France does the work, with a spare one on the main server in Germany. If the server in the European Union cannot be reached from your network directly, our relay server in Moscow passes the question on and does not keep its body. The club list and Gallery marks live on the server only while the calculation runs and never reach the database or the logs. The answer carries an issue mark: a short string that tells us which account got the answer and on which day. The mark log keeps an account fingerprint, a seat fingerprint, the day, the kind of question and a fingerprint of its body for 90 days. The admission log keeps, per account and day, the number of questions, seat fingerprints, network address fingerprints and how many questions came without a live seat or with an old proof, also for 90 days. This way we see when one access is used by many people. Market price files and the Gallery catalogue are served against the same proof, and the server counts how many addresses a day the proof came from, by address fingerprints only; that count lives 30 days. There are no clubs, emails or network addresses in these logs.

ESHArio has no advertising and no third-party analytics. There are no advertising networks, no third-party counters and no crash reports that send themselves: a problem report leaves only when you press the button. Everything the extension sends by itself is listed in this section and goes only to our server. The server keeps the "web app open" mark for signals in memory. For scanner subscribers the server keeps a 7-day signal delivery log (whether the web app was online when each signal came), to answer "why didn't the signal arrive". Requests to EA's servers are only the ones the web app itself makes with your own EA session; they carry no identifier of ours.

Permissions taken ahead of time

The ESHArio folder on your computer can only be changed by a new archive, so some permissions in it are taken ahead of time: new features should not require installing the extension again. Today no feature uses them; when one starts, this page will say what it gives.

• power: keep the screen from turning off while a long task of the extension runs; the request is dropped by itself when the last Web App tab is closed.
• declarativeNetRequestWithHostAccess: rules for requests to the sites in the manifest. One rule can be switched on by our server: remove the security policy header from the EA Web App page itself, if EA tightens it and ESHArio's code stops working. The rule touches no other page.
• webNavigation: learn which frames a tab of a manifest site consists of.
• sidePanel: the ESHArio side panel in Chrome; it does not exist until our server switches it on.
• Three keyboard commands with no keys: you assign the keys yourself on Chrome's extension shortcuts page.
• activeTab: a snapshot of the visible tab of a manifest site, for example to attach a frame to a problem report.
• On-request access to other sites over https. Chrome does not grant it at install; it grants it only when you press a button in the ESHArio window yourself, one site at a time, and you can take it back in the extension's Details.

What ESHArio never touches

• Your EA credentials. ESHArio does not read, store, transmit or fill in your EA email address, your password, or your two-factor code. You sign in yourself, in EA's own form. The only thing ESHArio presses on its own is the platform choice after you are already signed in, which saves one click.
• Your cookies and your EA session. ESHArio does not read cookies. It does not request the cookies permission and cannot.
• Your browsing history. ESHArio does not have the history permission. It does have the tabs permission: with it the extension finds the Web App tab and opens our website. It does not collect, keep or send the addresses of your other tabs.
• Other websites. ESHArio has no permission to run anywhere except the four third-party sites named above (the EA Web App among them) and our own website and server *.eshario.com with its spare name *.eshario.app, which it writes to: sign-in, access rights, password recovery, the settings, the problem report, the Telegram link and signal settings you send by pressing a button, the sales log, the card memory, the action counters, the usage summary and the consent from the "What goes to the server" window, and from which it downloads the card reference, the latest version number, ESHArio's code and signals. Access to any other site exists only on request: on your press, one site at a time, and you can take it back in the extension's Details.
• Whom you traded with. The extension does not record the names of sellers and buyers on the market and sends them nowhere.
• The email and date of birth of your EA account. The extension does not record them and sends them nowhere; our server knows the EA account only by an irreversible fingerprint.
• Your clipboard's contents without your action. ESHArio places into your clipboard what you asked it to copy, such as a problem report. It holds the permission to read the clipboard ahead of time, for pasting on your press; today no feature reads it.
• Downloads and notifications without a reason. The permissions to save files and show notifications are there to save files you asked for and to show notifications about the extension's own events. If the Chrome window is minimised, a notification may show a signal that has arrived.

Accounts and paid access

Since version 2.9.0 ESHArio works only with paid access for a term: without it, the extension shows only the sign-in window. Access is opened in an account or by a licence key. You sign in yourself, inside the extension and never on an EA page. The sign-in request to our server api.eshario.com carries exactly four things: your email, your password, a random device name the extension invents for itself, which is tied to nothing but our own extension, and a short device label such as "Windows · Google Chrome": the "new device" email names it, and the limit on devices per account counts it. A password reset request carries only your email. A new password goes together with the one-time code from the link in the email. Like any request on the network, they arrive from a network address; what happens to it is described below. What comes back after signing in is a signed statement of your paid access and a session token; later requests to the server carry that token, while signing in itself and password recovery go without it.

One computer and one phone at a time. One account works at the same time on one computer and one phone. To make this rule work, the extension computes a fingerprint of the computer on the web app page from a few traits of its hardware and system: the number of processor cores, the amount of memory, the graphics card, the operating system and the screen size. The traits themselves are never sent and never stored. Together with your account number they become an irreversible hash, a short string from which the traits cannot be recovered, and only that string goes to the server. So two accounts on the same computer have different fingerprints.

While the web app is open and paid access is active, the page tells our server every few minutes that it is running. This message carries the signed statement of your paid access, a seat mark (an irreversible hash of the device number that the server itself wrote into the statement), the computer fingerprint and a note saying "computer" or "phone". If an EA account is open in the web app, the number of market searches of this browser for the day and the hour is added, with an irreversible fingerprint of the EA account computed together with your ESHArio account number: so the day count is shared across all your computers. After you press "Continue here", a mark of that press is added; after you press "Got it" in the "What goes to the server" window, the edition number of the window text and the time of the press (see "Consent and how to withdraw it"). The server does not store the network address of these messages. It keeps the computer fingerprint and the times of the messages for no longer than 48 hours after the last message, and the times of moves from one computer to another for 24 hours; when the account is deleted, they are erased at once. They are not used for advertising and are not passed to third parties.

From these messages the server decides only one thing: on which computer the account is running with paid access right now. If the account is open on two computers at once, the extension on one of them is paused; how long to wait before the next switch, the server counts from the times of earlier switches. How the rule works and how to get a second seat is on the “One computer at a time” page.

The server holds: your email address, an irreversible hash of your password (never the password itself), device sessions, orders, an account event journal (a sign-in, a sign-out, a renewal, a new device), the date and edition of the consent from the "What goes to the server" window and a mark that you opted out of offer emails. A session is limited in time and in the number of devices. The "set your password" link from the email works for 24 hours and once. The IP address is used to restrict how often sign-in, orders and card-reference downloads can be attempted and is not stored in the database; an order keeps only a hash of it, from which the address itself cannot be read (see "The website and your purchase").

On your computer the extension keeps a signed snapshot of the access (it keeps the extension working offline for up to 7 days) and the session token. The session token goes to our account server only; the EA page and any other website cannot reach it.

The extension's settings go to our server with the "Save settings" button and, with paid access, by themselves while "Sync this computer" is on (see "Moving your settings to another computer"). Club lists, the request log and the licence key do not travel.

After you sign in to the ESHArio account, these travel by themselves and are kept under your account, so that all your computers have the same:

• The sales log. Your trade totals are the same on every computer.
• The card memory (with paid access). Locks, freezes, purchase prices, the extension's book of deals and the other marks from "What is stored on your device".
• The action counters (with paid access). How many market searches, purchases and challenge submissions there were in each 10 minutes, pauses after an EA refusal and stopped days, with a random browser number. So pauses and limits are counted across all your computers together. They are kept for 48 hours.

These records know the EA account only by an irreversible fingerprint: the number and name of the EA account do not go to the server, and the server turns the fingerprint once more with its own key, which is kept apart from the database. The sales log and the card memory are kept until the account is deleted and are deleted with it.

For the monthly top of traders the server keeps your monthly trade total (number of deals and coins after tax) and your choice to take part in the top with your EA club name, if you turned it on. Deleted together with your account. If you turned on taking part and made the top ten, other ESHArio users see your club name, league, place and monthly trade total after tax in the top.

The server keeps records of refused requests to closed doors for 30 days. A record holds a fingerprint of the network address, the door, the reason and the account number when known. No email and no raw address are stored.

Usage summary

So that the extension works the same on all your devices and so that we understand how to make it better, ESHArio with paid access updates a short summary of the day on our server during the day (at most once every 10 minutes, the server keeps one per day): how many actions the extension took and at what hours, whether there were breaks and whether you continued after a prompt, which speed settings were on and when they changed, how many tabs and devices worked, how many matches were played, whether trading was available in the web app at sign-in, the country of sign-in and whether the city changed during the day (the city itself and the network address are not kept), and for each deal the card, the purchase and sale price, the time and the usual price of the card at that moment. No extra requests go to EA for this: everything comes from the answers the web app has already received.

If the EA web app reported an EA decision on your account, the extension sends once a compressed log of the last 7 days and your settings, so that we can see what happened before it and do not have to ask you for a file.

Copies without paid access send only a day mark once a day: a random number of this copy, its version and whether an account was signed in. There is no email, no EA account and no actions in it.

We do not keep the number and name of your EA account, the club name (except for the monthly top, if you turned it on yourself), the EA email or whom you traded with: the EA account is recorded with us by an irreversible fingerprint under a key that is kept apart from the database. Deals with a price far above or below the usual one are marked for general statistics. Summaries, compressed logs and marks are kept for 90 days and are deleted together with the account. They have no effect on refund decisions. Summaries are processed by the server; a member of the ESHArio team looks at the summary of a particular account only at your request or when the law requires it. There is no advertising and no third-party analytics, and we sell the data to no one.

Sending the summary, the compressed log and the day mark can be switched off: the settings window, the "Account and help" section, the "What goes to the server" row, the "Usage summary" switch. It does not switch off what the features themselves cannot work without: the action counters, the sales log and the card memory (see "Accounts and paid access").

Problem reports

The extension's settings window has a "Report a problem" button in the "Account and help" section. In its window you write a few words about what happened and choose what to do with the report yourself:

• "Send": the report goes to our server, and we receive a short summary of it in our Telegram. It leaves only when you press the button.
• "Copy report": the report is placed in your clipboard, and you decide whom to send it to.
• "Write to support": our support Telegram opens; what to write is up to you.

What a report holds: your words; your Telegram for a reply, if you entered it (the field is shown only to people who are not signed in); the extension version, browser, system, window size and language; which Web App screen is open and which of our additions are on it; the extension's errors during this session and its recent events; your settings (the same set as "Save settings" carries); your plan and the days left. If you are signed in, the server links the report to your account itself and adds the account email to the summary we receive in Telegram, so that we can answer you.

What a report never holds: your EA login and password, your ESHArio password and session token, the access snapshot, the licence key, your email, your club list, card identifiers, the purchase log, the request log and screenshots. No email leaves your computer inside the report either: anything that looks like an email address or a key is removed before sending and once more on the server; the account email of a signed-in person comes from our own database.

A report is kept in our database on the rented server for 90 days and then erased; it is deleted together with the account. The device number and the network address are kept next to the report only as hashes, from which the values themselves cannot be read: they are needed to limit how often reports can be sent. The Telegram summary carries an email only if you are signed in. Messages in Telegram are kept by Telegram under its own rules.

Signals and Telegram

Signals are short ESHArio messages about cards and prices: a signal from the ESHArio scanner, a price bell (a card's price reached the one you set), a stop of buying or squad building, and paid access running out soon. While the web app is open, a signal arrives as a small window in the corner of the web app. If you linked your Telegram, a signal may also arrive as an ESHArio message in Telegram. Which signals arrive and where, you choose in the "Signals" section of the extension's settings. Everything except the message about paid access running out works only with paid access.

Waiting for a signal. While the web app is open with paid access, the extension keeps a connection to our server so a signal arrives at once. Each request waits up to 25 seconds for an answer and carries the signed statement of your paid access (from it the server learns the account number), the number of the last signal received and the platform of the EA account (console or PC). There is no session token, no cookie and no email in it. The server keeps in memory only a mark "this account's web app is open", to know whom to hand a signal. There is no log of these connections: the mark disappears no later than two minutes after the web app is closed. The one exception is the signal delivery log for scanner subscribers (in the table below). Web app closed, no requests. Waiting for a signal makes no request to EA. A press of "Catch in the web app" in Telegram and a bell that went off wait in server memory for up to 10 minutes until the web app opens; they are not written to the database.

Linking Telegram. You switch it on yourself with the "Link Telegram" button in the extension's settings. The extension shows a one-time code that lives 10 minutes, and you confirm it in the ESHArio chat in Telegram. The server keeps the code only as an irreversible hash. After linking, the server keeps the numeric ID of your Telegram chat with your account, to send you private messages. We do not keep your Telegram username, name or phone number. Your account email never goes to Telegram: messages carry only the card, the prices and the reason. One Telegram links to one ESHArio account, and a new link removes the old one. When you link, the extension also gives the server the name of your computer's time zone (for example Asia/Tbilisi), so times in messages are your own and quiet hours at night work.

Price bells. You set a bell on a card yourself, to be told when its price goes above or below the one you set. The server checks it once a minute against the shared market price file; no request goes to EA for this.

A stop of buying. If buying or squad building stops (an EA refusal, a wait until morning, work on another computer), the page tells the server once what stopped, why and until what time. Whether to write to you about it in Telegram, the server decides by your settings.

What the server keeps for signals:

Link with the ESHArio scanner. The ESHArio scanner is a separate product from the same seller: it looks for profitable cards on the market and sends signals to its own Telegram. The scanner passes our server the signals themselves and a list of the numeric Telegram IDs of people who paid for the scanner, with the platform and the date it is paid until. From that list the ESHArio server records only the IDs that match Telegram accounts linked to ESHArio accounts; the rest are not written to the database and stay in the server's memory only until the next list. If you press the button under a scanner signal in Telegram that leads to the web app, the scanner tells our server your Telegram ID and the signal number, and the server hands the signal to your open web app. ESHArio gives the scanner only a short reply text for that press. If you bought the scanner from us and linked Telegram, we pass the ESHArio scanner your Telegram ID, the platform and the scanner term, so that it lets you into the scanner forum and does not remind you to pay in Tribute. Your email, account number, settings, order amounts and numbers and everything stored on your computer never go to the scanner. Both products are sold by one seller, so this is an exchange inside one seller, not a transfer to a third party.

How to unlink and erase. The "Unlink" button in the "Signals" section erases the chat ID on the server at once, together with the time zone and the scanner paid-until date. You remove price bells with the cross in the same place. Everything listed above is deleted together with the account at your request. Messages that already reached you in Telegram are kept by Telegram under its own rules. The legal basis for handling your Telegram ID is your consent, given by linking; you can withdraw it at any time with "Unlink".

All of this lives in our database on the same rented server as the account; only we have access to it, and the connection is encrypted (HTTPS).

The website and your purchase

Our website eshario.com sets no cookies. It has three forms. The purchase form: the email, the chosen term, the promo code and the page language go to our server when you press "Pay"; for the time of payment the page keeps the order number in this browser tab's storage, to show it on the "Your order" page. The purchase page remembers the chosen scanner platform and term for 30 days only in your browser's storage, so that you do not have to choose them again on a new payment attempt; they go to our server only with the order. With the order our server records the country: only its two-letter code, which the Cloudflare delivery network our server runs behind names by the network address; the network address itself is not kept in the order. The order also carries where you came to the site from: the name of the linking site and the campaign tag from the address, if there were any (the page keeps them in this browser tab's storage; they are used to count payments by source); the page address itself is not kept. The promo code field: the code you enter is kept in your browser's storage so you do not have to type it again, and is sent to our server when you press "Apply" (to show the price; the buy page checks a saved code the same way by itself) and "Pay"; nowhere else. And the new-password form on the /password page, which the link in our email opens: the password you type goes once to our account server and nowhere else. The site is served through a hosting provider; like any host, it keeps technical logs with visitors' IP addresses, they live with the host under its rules, and we do not read them. The visit counter, when enabled, works without cookies and without identifying the visitor; it is not on the purchase and order pages. On the purchase page the site counts page openings by the link tag (where the visitor came from), without cookies, without the address and without identifying the visitor; the daily count is kept for 90 days.

Payment. The payment is processed on the side of one of our payment partners. On the purchase page and on the order page the code of one of them runs: it matches your email and the technical data of the session (browser, device, network address) against the payment, so that the payment goes through correctly and safely; sometimes the partner may ask you to pass an additional check before paying. The partner processes this data under its own policy, and what its code keeps in your browser is also up to the partner. From the partner that took the payment we receive order data: the number, the amount, the date, the payment status and the payment method; one of the partners also sends the email given at checkout. We never see card details.

Emails about the key, the account and our offers are sent by a mail service from noreply@eshario.com; it sees the address and the text of the email. Order and account records are kept on our rented server; only we have access to it. Support emails arrive through email forwarding into our mailbox; Telegram conversations are stored by Telegram under its rules. Our hosting and mail suppliers process data on our instructions.

What we keep about a purchase, and why:

• Email and order number: to deliver the key and answer emails.
• Amount, term, promo code: refunds and the partner's reward.
• Order records: tax accounting.
• Order country: counting payments by country.
• Email: we may send buyers an email about new offers and discounts; you can opt out with the link in any such email or through support.
• Support correspondence: to help you.
• Delivery log, the record of consent to the documents, the network address hash and correspondence in a dispute: defence against payment disputes and abuse.

We process purchase data to perform our contract with you and to meet legal requirements; offer emails to buyers are sent in our legitimate interest until you opt out. Our suppliers (hosting, mail, the payment partner) may be located in other countries and work under contracts with us.

Order records are kept as long as tax accounting requires; an account lives until you ask us to delete it. Your rights: to learn what we hold about you, to correct it, to delete it, and to object to its processing. The partner whose promo code you entered does not see your data: only the fact of payment and the term.

Sharing and selling

ESHArio does not sell your data, does not share it for anyone else's advertising, and does not use it to assess creditworthiness or for lending. Purchase data is used only for delivery, support, refunds, tax records and emails to buyers about our offers (you can opt out of them), and is passed only to the suppliers named in the section "The website and your purchase", in the amount their work needs.

Between ESHArio and the ESHArio scanner pass only signals, Telegram IDs with the scanner paid-until date and platform, and the reply to a press of the button under a signal (see "Signals and Telegram"). Both products are sold by one seller.

The use of information received through ESHArio adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

How long data is kept, and how to delete it

What is deleted from the database also disappears from the daily backups within 7 days at most. The earlier form of the records, in which the EA account fingerprint lay without the server key, leaves the backups within the same 7 days. Deleting the account erases everything kept under it on the server, except the order and payment records that tax rules require.

To delete everything on your computer, remove the extension from chrome://extensions. Chrome deletes the extension's local storage with it. Removing the extension deletes nothing in your EA account. Retention for purchase data is set out in the section "The website and your purchase", for signals and Telegram in "Signals and Telegram".

Children

ESHArio is not directed at children and does not knowingly collect data from them. Apart from the account email, the purchase data, a problem report a person sends themselves, a Telegram chat ID a person linked themselves, the data the features need to work (the sales log, the card memory, the action counters) and the usage summary, the extension collects no personal data from anyone; access may be bought by a person with legal capacity, and children may use the extension only with parental consent.

Consent and how to withdraw it

On the first start of a version that sends the usage summary, the extension shows a signed-in person the "What goes to the server" window: what exactly is sent, why, and where to switch it off. The "Got it" button records the date and the edition number of that text in your account; they reach the server with the next "running" message. The window can be opened again at any time: the settings window, the "Account and help" section, the "What goes to the server" row.

You can withdraw consent there with the "Usage summary" switch: sending stops at once. To delete what has already been sent, write to us from the account email (see "Contact"): the account and everything kept under it on the server, including summaries, logs and the event journal, is deleted within 10 working days. Only the order and payment records that tax rules require remain.

Changes to this policy

If ESHArio's handling of data changes, this page is updated first, with a new date at the top, and the Chrome Web Store listing is updated at the same time.

Contact

Website: https://eshario.com Email: support@eshario.com Requests about your data: from the email given at checkout; we reply within 10 working days.