Privacy Policy for Zion Jet Lister

Last Updated: September 28, 2026

This Privacy Policy explains how Zion Jet Lister ("we", "our", or "the extension") handles user data when you use our Chrome extension.

1. Overview

Zion Jet Lister is a browser extension designed to help users import vehicle inventory listings from admin-assigned dealer/inventory websites, manage and interact with Facebook Marketplace listings more efficiently, and view performance statistics for their own Facebook Marketplace listings.

We are committed to protecting user privacy and ensuring transparent data handling practices.

2. Information We Access

2.1 Page Content on Admin-Assigned Sites and Facebook (On-Page Data)

When you use the extension on a website assigned to you by your organization's admin (for scanning vehicle inventory), or on Facebook Marketplace (for posting/managing listings), it may temporarily access:

• Public listing titles
• Product/vehicle descriptions
• Prices
• Images visible on the page
• Listing metadata displayed by the page

👉 This data is only used to provide extension functionality while you are actively using an admin-assigned page or Facebook Marketplace.

We do NOT permanently store this data unless explicitly saved by the user, or automatically saved as part of a user-initiated or user-scheduled scan or a user-initiated performance refresh (see Sections 2.2, 2.4 and 2.5).

2.2 User Actions Inside Extension

The extension may process:

• Button clicks
• Selection of which listings to scan (via on-page "Scan" / "Scan All" / "Skip" controls)
• Filtering, searching or sorting actions
• User-selected settings
• Auto-scan scheduling preferences (interval duration set by the user)

This data remains local to your browser unless explicitly sent for processing.

2.3 Local Storage Data

We may use Chrome's local storage to save:

• User preferences
• Extension settings
• UI configuration
• Auto-scan schedule settings (on/off state and interval)
• The list of URLs assigned to you by your admin (cached locally so the extension can verify which pages it is authorized to run on)
• A copy of your most recent Listing Performance results and the time of your last refresh (so the dashboard can display them and enforce the once-per-day refresh limit)

This data stays on your device and is fully controlled by you.

2.4 Backend Communication & User Accounts

The extension communicates securely with our backend server to provide account management and data persistence:

• Account Data: We securely process and store your name, email, account password hashes, and user roles to manage authentication tokens (JWT).
• Assigned URLs: Your admin assigns specific dealer/inventory website URLs to your account; these are retrieved from and stored in our backend so the extension knows which pages it is authorized to operate on.
• Saved Progress: When explicitly triggered by user actions (or by a user-enabled auto-scan), the extension saves vehicle listing details (VIN, Title, Price, Mileage, Images, and posting statuses) to your secure private workspace database.
• Listing Performance Statistics: When you refresh the Listing Performance dashboard, the statistics described in Section 2.5 are saved to your private workspace, linked to the vehicle listing they belong to.
• All communication is encrypted via HTTPS. We do NOT sell, rent, or share user data with third parties.

2.5 Listing Performance Data (Your Own Facebook Marketplace Listings)

The extension includes a Listing Performance dashboard that shows how the Marketplace listings you posted with Zion Jet Lister are performing. When you click that dashboard's Refresh button (allowed at most once per day, resetting at 12:00 AM your local time), the extension reads the following from your own Facebook Marketplace "Your listings" page, while you are signed in to Facebook in Chrome:

• The number of clicks on each listing, as shown to you by Facebook
• The number of buyer conversations for each listing (a count only)
• The number of views for each listing, where Facebook displays this
• Each listing's Facebook listing ID, title and price, used only to match it to the corresponding vehicle in your workspace

What the extension does NOT do:

• It does not open, read, store or transmit the content of your conversations, and it does not store buyers' names or profiles. Conversations are counted, never opened, so they are not marked as "seen".
• It does not read other people's listings, your Facebook friends, your personal profile, or any Facebook page other than your own Marketplace selling page.
• It does not post, edit, message or change anything on Facebook while refreshing statistics.

How it works: to avoid interrupting you with a new tab or window, the extension loads your Marketplace selling page inside an invisible page managed by Chrome (an "offscreen document"). While this page loads, the extension temporarily adjusts Facebook's frame-related response headers for that invisible page only (see Section 6). The invisible page is closed and the temporary adjustment is removed as soon as the refresh finishes. This processing happens entirely in your own browser; only the resulting numbers listed above are sent to our backend.

Who can see these statistics: you, and — if your account is part of a team — your team's account owner, in the extension's Activity dashboard.

3. How We Use Information

We use accessed information strictly for:

• Enabling core extension features
• Verifying that a page is authorized for scanning by your admin
• Improving inventory-import and Facebook Marketplace workflow efficiency
• Processing user-initiated actions
• Providing optional backend-powered features
• Displaying listing performance statistics to you and, where applicable, your team's account owner
• Running scheduled background tasks (auto-scan and listing health checks) as configured by the user

We do NOT use data for advertising or profiling.

4. Data Storage & Retention

• Account registration details and user-saved listings are stored securely in our private backend database until explicitly deleted by the user or account owner.
• Listing performance statistics are stored with your workspace while your account is active and are deleted when the related account is deleted.
• Local data cached inside "chrome.storage.local" (including your last Listing Performance results) is fully controlled by the user and can be cleared instantly by logging out or uninstalling the extension.
• Auto-scan schedule settings are stored locally in chrome.storage and are cleared when the user disables the feature or uninstalls the extension.

5. Third-Party Services

Zion Jet Lister interacts with:

• Facebook (facebook.com) for listing management functionality, and for reading performance statistics of your own Marketplace listings when you request a refresh
• Admin-assigned third-party dealer/inventory websites, for the purpose of reading publicly displayed vehicle listing data
• Our backend API (secure cloud-hosted service)

We are not responsible for the privacy policies or data handling practices of Facebook or of third-party dealer/inventory websites.

6. Permissions Used

The extension requests only the permissions necessary to provide its features:

• Host permissions (<all_urls>) — Zion Jet Lister is used across a variety of dealer/inventory websites, which differ by organization and are assigned individually by each admin rather than being fixed to one domain. Because the specific sites vary per customer and are not known in advance, we cannot scope host permissions to a fixed list of domains. The extension only activates its scanning UI and scraping logic on pages that the background script has verified are on the current user's admin-assigned URL list (see Section 2.4); on all other pages the extension remains idle and does not read or transmit page content. Facebook Marketplace access under this same permission is used to auto-fill and manage listings the user creates, and to read the performance statistics of the user's own listings when the user requests a refresh (see Section 2.5).
• storage — to save user preferences, settings, scan schedules, the locally cached list of admin-assigned URLs, and the user's last Listing Performance results.
• activeTab — to interact with the currently active browser tab when the user triggers an action from the popup.
• downloads — to allow users to export or download listing images/data.
• scripting — to programmatically inject the extension's content-script logic into tabs that the extension itself opens or navigates during automated workflows, such as: the navigation-based inventory scanner moving between listing URLs, the scheduled auto-scan opening a background tab, and the automated Facebook Marketplace listing-removal flow. This ensures the scanning/interaction logic is present in tabs that are created or navigated programmatically, outside of a normal user-initiated page load.
• offscreen — to load the user's own Facebook Marketplace "Your listings" page in an invisible page (an offscreen document, reason: DOM scraping) when the user clicks Refresh in the Listing Performance dashboard, so that listing statistics can be read without opening a visible tab or window. The offscreen document is closed as soon as the refresh finishes and is not used for any other site or purpose.
• declarativeNetRequestWithHostAccess — used only during a user-requested Listing Performance refresh. Facebook's pages normally refuse to be displayed inside a frame, so the extension adds one temporary session rule that adjusts Facebook's frame-related headers for requests coming from the extension's own offscreen page. The rule never applies to the user's normal browser tabs, never blocks or redirects any request, and is removed as soon as the refresh finishes.
• alarms — to schedule and run two periodic background tasks without requiring the extension popup to remain open:
  • Auto-scan: When enabled by the user, the extension schedules a recurring inventory scan at a user-defined interval (e.g., every 2 hours). This uses chrome.alarms because Chrome's Manifest V3 service workers do not support persistent timers like setInterval.
  • Listing URL health checks: A background alarm fires every 6 hours to verify that saved Facebook Marketplace listing URLs are still active, so users can be notified of removed or expired listings.
• Network access — to communicate securely with our backend API via HTTPS.

We follow the principle of least privilege: the extension only reads or acts on page content for (a) pages explicitly assigned by an admin, or (b) Facebook Marketplace pages belonging to the user, when the user is managing their own listings or has requested a performance refresh.

7. Background Activity

The extension runs limited background tasks using Chrome's alarms, scripting and offscreen APIs. These tasks are:

• Only active when enabled by the user (auto-scan), necessary for data integrity (URL health checks), or triggered directly by a user action (e.g. deleting a sold listing, or clicking Refresh in the Listing Performance dashboard).
• The Listing Performance refresh never runs on its own: it runs only when the user clicks its Refresh button, at most once per day. Reloading the extension page or refreshing other dashboards does not trigger it.
• Restricted to admin-assigned pages and Facebook Marketplace, per Section 6.
• Do not collect, transmit, or store any personal data beyond what is described in this policy.
• Can be fully disabled by turning off auto-scan in the extension settings, by not using the Listing Performance Refresh button, or by uninstalling the extension.

8. Data Security

We implement industry-standard security practices:

• HTTPS encrypted communication
• No unauthorized sensitive data storage
• Secure storage of data profiles explicitly requested by user features
• Restricted access to server resources

However, no system can guarantee absolute security.

9. User Control

Users may:

• Disable or remove the extension at any time
• Clear all stored data via Chrome settings
• Block or restrict permissions through browser controls
• Disable the auto-scan feature at any time from the extension popup to stop all scheduled background activity
• Choose not to use the Listing Performance Refresh button, in which case no listing statistics are read from Facebook
• Request deletion of stored listing performance statistics by contacting us (see Section 11)
• View the list of URLs currently assigned to their account via the "Allowed Links" section of the extension popup

10. Changes to This Policy

We may update this Privacy Policy occasionally to reflect improvements or changes in functionality.

Updated versions will always include a revised "Last Updated" date.

11. Contact Information

If you have any questions about this Privacy Policy or Zion Jet Lister, you may contact us at:

Email: colin@ikonicdigitalmarketing.com

Website: https://admin.zionjetlister.com/