Privacy policy

Simulated Shopping at simulated.shopping. Last updated [TO CONFIRM: publication date]. Version 2026-10-16 (the version sign-in and the Keep your Double panel send; a new version changes both).

The short version

• Simulated Shopping never places an order and never moves money. A real purchase happens only at a store's own checkout, after you say yes there.
• We receive what you choose to send us, plus the basic technical details every website receives.
• Guesses about your body or health, and lines about kids, never reach us. If one arrives anyway, we refuse it and keep no copy.
• Nothing we make acts on Amazon: we never sign in, click, shop or make requests there for you.
• We don't sell or rent your data, share it for advertising, run ads or use affiliate links.
• You can see, export or delete everything in your account at any time, and deleting starts at once.
• Simulated Shopping is for people 18 and older.

Who we are

Simulated Shopping is made by Two Planets Away LLC [TO CONFIRM: legal entity (B32)] ("we", "us"). It runs at simulated.shopping.

Free your Double (freeyourdouble.com) is our campaign. Its own privacy policy, at freeyourdouble.com/privacy, covers that page and the chat there. This policy covers your Simulated Shopping account and everything that reaches it, including what the freeyourdouble.com page sends when you keep your Double.

Questions and requests: ben@twoplanets.org [TO CONFIRM: contact address; the plan later adds privacy@, support@ and security@ addresses]. Post: [TO CONFIRM: business address for the legal pages (B32 record)].

We're not affiliated with Amazon or with any store.

What we collect, and why

Your account

When you sign up or sign in, we collect:

• Your email address, to send you sign-in codes and to know it's you. There's no password.
• Sign-in codes. We store each one only as a keyed hash. It works for 10 minutes and allows 5 tries, and the record is deleted within a day.
• Your agreement: which version of the Terms you accepted, when, and when you confirmed you're 18 or older.
• Settings you choose, such as a display name, time zone, home currency and language. Your time zone decides when your monthly edition closes.
• Your connected devices. Each browser, extension or app you connect gets its own credential. We keep only a hash of it, the device's own name (for example "Chrome on MacBook Air") and when it was last used, so you can see each one and revoke it.
• Security records: sign-ins, new devices, exports and deletions, with a keyed hash of the IP address (never the address itself) and the browser family. We keep them for 90 days.

Keep your Double

When you tap Keep your Double on freeyourdouble.com, that page sends us:

• your email address;
• your Double's shoppable lines, word for word;
• the receipt it printed, if there is one: each item's title, listed price, currency and store, and the line it was picked for;
• your email choices: the Black Friday email (Nov 27) and the returns-day email (Dec 27);
• your agreement to the Terms and your 18+ confirmation.

The page removes VOID lines (body, health, intimacy, beliefs, money and age) and lines about kids before it sends anything. We check again when the request arrives. If one gets through, we refuse the whole request, and the line reaches no database row, log or email. Receipt items the Double never buys, such as gift cards, alcohol or weapons, are refused the same way.

The request waits for the 6-digit code we email you, which works for 10 minutes. If you don't enter it, its lines, receipt and email choices are deleted when the request runs out (30 minutes at most), and the rest of it, your email address included, within a day. Once you enter the code, everything moves into your account.

simulated.shopping on the web

• Your Double. Your account shows your Double, its receipts and your email choices, with buttons to export or delete them.
• Your collection [TO CONFIRM: when the collection opens to accounts]. When you add something with Virtual Buy, we store what you chose to add: the product's name, listed price and currency (or "Price unknown"), brand, store, a link to the product page with tracking codes removed, and a link to its image. We also store what you do with it: captions and notes you write, your decisions (Still want, Passed for now, Undecided), your display shelf and your monthly editions.
• Product images. Until we keep our own copy of each image, your browser loads it from the store's website, so that store can see your IP address when you look at your collection [TO CONFIRM: remove this line once images are copied at the moment you add them (B14)].

The browser extension

Today, as "Simulated Shopping: Free your Double":

• It needs no access to websites. It sees your Amazon About You page only when you click it, and only that page.
• It reads the text already on the screen. It doesn't click, navigate, sign in or make requests to Amazon.
• It sorts the lines on your computer and hands them to the freeyourdouble.com page in your own browser. It sends us nothing.
• It keeps a summary of your last receipt on your computer.

With Virtual Buy, in an update you approve [TO CONFIRM: release timing]:

• The extension reads a page only when you click Virtual Buy (or, if you turned on the automatic button, it checks pages on the stores you chose without sending anything).
• When you click, it sends that page's product details to your account to fill in the sheet. If you choose Not now, we delete them at once. If you don't add the item, we delete them within 24 hours.
• It never sends pages you don't click on. The page details behind an item you added are kept 30 days, so we can fix mistakes in how a store's page was read.
• It keeps its connection to your account and your preferences on your computer.

Email

• We send email through Resend, from mail.simulated.shopping: sign-in codes from hello@mail.simulated.shopping, and your Double's emails from double@mail.simulated.shopping, only if you chose them. Replies go to ben@twoplanets.org [TO CONFIRM: reply-to address].
• To send an email, we hold your address and the message until it goes out. After that we keep a delivery record (which email, when, whether it arrived, and a hash of your address) for 90 days.
• If an email bounces or is marked as spam, we keep a hash of the address so we stop sending to it [TO CONFIRM: the suppression list is planned but not built yet].
• Delivery events (delivered, bounced, marked as spam) also go to our studio's own operations dashboard, without your address.
• Our emails don't track opens or clicks [TO CONFIRM: open and click tracking is off for mail.simulated.shopping; a tracking domain is set up there].
• Your Double's emails have an unsubscribe link. Sign-in codes and account notices go to every account, because the account needs them.

The Claude connector (later)

[TO CONFIRM: when the connector opens; this section describes the plan.]

• You can connect Claude to your account at simulated.shopping/mcp. You sign in with your Simulated Shopping account and choose what Claude may do: read your Double, update its lines and hauls, add Virtual Buys, or prepare a checkout link for you to review and pay at the store. It can never pay.
• What Claude reads through the connector goes to your own Claude account, under your agreement with Anthropic. We don't send your data to Anthropic or any other AI company ourselves [TO CONFIRM: no model calls from simulated.shopping at launch].
• When the connector looks up products for your Double, it sends search words, never your email or account, to Shopify's public catalog search [TO CONFIRM: product search through the connector].
• VOID lines and lines about kids sent through the connector are refused, the same as anywhere else.
• You can disconnect it at any time from your list of connected devices, and it stops at once.

Technical details every website receives

• Request logs. Our hosting provider, Vercel, receives each request's IP address, browser type, time and the address requested, and keeps them in its logs for 1 day, the shortest it offers.
• Abuse limits. We use IP addresses to stop abuse. Our own counters hold a keyed hash, never the address, and clear within minutes.
• No product links in web addresses. Product links and search words travel inside requests, never in the web address, so they don't land in request logs.
• One cookie. A single cookie keeps you signed in on simulated.shopping. We use no advertising or tracking cookies, and our pages load their fonts from our own site, not from Google.
• Counting a few actions. We count two things with PostHog, so we know what's working: an account being created, and a Double being kept. Our server sends each one, with your account's ID (not your email), where it came from (freeyourdouble.com, or signing in) and, for a kept Double, how many lines and receipt items it has. Never the lines themselves, a title, a price, a name, an email or a link. Because our server sends them, not your browser, PostHog doesn't receive your IP address, and nothing is stored in your browser. No analytics script runs on our pages, in the extension or in our emails. Once you delete your account, the ID in those counts points to nothing we hold.
• Error reports. We don't use an error-reporting service. Errors go to our hosting provider's logs, without product links, titles, codes or tokens, and are kept as long as those logs.
• Store-reading accuracy (with Virtual Buy). To fix stores whose pages read badly, we count, for each store and day, how often each detail was found and how often people corrected it, with no account, link, title or price attached. It's on by default, and you can turn it off [TO CONFIRM: setting location]. We keep the raw details of a page only if you send us a report about it.

California notice

[TO CONFIRM: counsel to check these categories against the CCPA regulations.]

We don't sell or share personal information, as California law defines those words, and we haven't in the past 12 months.

What we never collect

• VOID lines and lines about kids. Guesses about your body, health, intimacy, beliefs, money or age, and lines about children, stay on your device.
• Anything from your Amazon account. Never your Amazon password, cookies or orders. Nothing we make signs in, clicks, buys or makes requests on Amazon.
• Your payment card. Simulated Shopping is free [TO CONFIRM: free during the beta] and asks for no card. When you buy something real, you pay at the store.
• Pages you don't click, and your browsing history.
• Your contacts, precise location, camera or microphone.

How we use it

• To run what you asked for: sign you in, keep your Double and your collection, show them to you, make your monthly edition, and send the emails you need or chose.
• To keep it safe: limit abuse, notice break-ins and keep security records.
• To fix and improve it: the two counts above, and later the store-reading accuracy.
• To follow the law.

We don't use your data for advertising. We don't sell it, rent it or give it to data brokers. We don't use it to train AI models [TO CONFIRM: a promise for Ben to approve]. We don't make automated decisions about you that have legal or similarly serious effects.

Stores, links and real purchases

• Store links in your collection are plain links to the store's page, with tracking codes removed. We use no affiliate links and earn nothing if you buy.
• If you say yes to buying something real, for example your Double's Black Friday pick, we send you to the store's own checkout. You pay there, under the store's terms and privacy policy. We never see or hold your card, and we never complete a purchase for you.
• [TO CONFIRM: freeyourdouble.com/privacy also names "Link" as a way to pay. Name the service here, and say what, if anything, we pass to it.]

Who we share it with

We share personal data only:

• with the service providers that run Simulated Shopping for us, under contracts that let them use it only to do that work;
• with Claude, through the connector, when you connect it and ask;
• when the law requires it, for example a valid court order, or to protect someone's safety;
• with a company that takes over Simulated Shopping, if that ever happens. We'd tell you first, and this policy's promises would go with your data.

Our service providers

Google distributes the extension through the Chrome Web Store, under Google's own policies.

How long we keep it

These windows follow decision B29 [TO CONFIRM: B29 is a default, open to objection until Jan 15, 2027].

Your choices and rights

These apply to everyone, wherever you live.

• See and export. Your account shows your Double. Export downloads all of it as one file, at once.
• Correct. Change it in your account, or write to us.
• Delete. Delete your Double, or your whole account, from your account page. Every sign-in and connected device stops working at once, and your data is erased from our live systems at the same moment; the page confirms it. Copies in backups age out within 27 days, and if we ever restore a backup, we delete your data again before anything uses it [TO CONFIRM: the deletion log that makes this possible (B28) is not built yet].
• Email choices. Use the unsubscribe link in any of your Double's emails, or change them in your account.
• Ask us. Write to ben@twoplanets.org. We reply within 30 days [TO CONFIRM: 30 days (plan §6.4.7) or 45 days (freeyourdouble.com/privacy); use one number on both sites]. We may ask you to confirm the request from your account's email address. Where the law allows, someone you authorize can ask for you.
• Appeal. If we turn down a request, we'll say why, and you can appeal by replying. We answer appeals within [TO CONFIRM: 45 or 60 days, per state law].
• No penalty. We don't treat you differently for using these rights.

US state privacy laws. California, Colorado, Connecticut, Oregon, Virginia, Texas and other states give these rights by law. We don't sell or share personal information, we don't use it for targeted advertising, and we don't use sensitive information to infer things about you.

Do Not Track and Global Privacy Control. We don't track you across other websites, and we don't sell or share your data, so these signals have nothing to switch off. We treat a Global Privacy Control signal as a request not to sell or share, which we already don't do.

Health data laws. Washington's My Health My Data Act and laws like it cover health data. We don't collect it: VOID lines never reach us, and the API refuses them if they arrive [TO CONFIRM: counsel (PREFLIGHT L2c)].

Your Amazon data. Amazon holds its own copy of your About You guesses and the rest of your file, and you have rights there too. Ask Amazon through its own privacy request page. We never make that request for you.

Security

• Every connection uses HTTPS, and browsers are told to insist on it.
• Sign-in codes are short-lived and stored as keyed hashes. Device credentials are stored only as hashes, and revoking one works at once.
• In our own records, IP addresses are stored only as keyed hashes.
• Our logs leave out product links, titles, notes, codes and tokens.
• Our database is encrypted on disk by its provider, Railway [TO CONFIRM: Railway's encryption at rest for volumes and backups].
• Only [TO CONFIRM: who has production access; Ben only?] can reach production data, and support actions are recorded.
• If a breach affects your data, we'll email you as soon as we responsibly can, and as the law requires.
• To report a security problem, write to ben@twoplanets.org [TO CONFIRM: security contact and /.well-known/security.txt].

Children

Simulated Shopping is for people 18 and older [TO CONFIRM: age floor (B32)]. Everyone confirms they're 18 or older when they sign up. If we learn that an account belongs to someone younger, we delete it. Your Double leaves lines about kids off its receipt, and we refuse them if they arrive.

Where your data is

We're based in the United States, and Simulated Shopping is hosted there: the website in Washington, D.C. (Vercel) and the database in Virginia (Railway). If you use it from another country, your data is handled in the US.

[TO CONFIRM: are accounts open outside the US during the beta? If so, counsel adds the GDPR and UK GDPR legal bases and transfer terms.]

The Chrome extension and Limited Use

Simulated Shopping's use of information received from its Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Today the extension reads one page, your Amazon About You page, only when you click it, and uses what it reads only to show you your Double. With Virtual Buy, it reads a store's product page only when you click, and uses what it reads only to add that item to your collection. We don't sell this information, use it for advertising, or let people read it except as this policy says.

Changes to this policy

Every version carries its date. If a change matters, such as new data, a new use or a new provider that sees your data, we'll email account holders at least [TO CONFIRM: notice period, e.g. 14 days] before it takes effect, and post it here. Earlier versions are available on request.

Contact

Two Planets Away LLC [TO CONFIRM: legal entity (B32)], ben@twoplanets.org [TO CONFIRM: contact address], [TO CONFIRM: business address].

The Terms of service are at simulated.shopping/terms.