Extension privacy

Last updated: October 29, 2026.

This policy covers the Vintarget Connect browser extension.

Data controllerCopy Anchor Link

TO BE COMPLETED: company name, address and contact of the data controller.

For any question about your data: hello@vintarget.fr.

The data readCopy Anchor Link

The extension reads only two cookies of the vinted.fr site: access_token_web and refresh_token_web. Together, they are the Vinted session open in your browser.

To recognize the Vinted account open in your browser, it reads that account's identifier (its Vinted user number) inside access_token_web. This reading happens on your computer: the identifier is handed to no one.

To know when you sign in to Vinted, the browser tells it about the changes to vinted.fr's cookies; it only looks at their name, to spot access_token_web, whose Vinted user number it then reads (see the history below).

It reads nothing else: not your browsing history, not the content of the pages you visit, not the other cookies of vinted.fr or of any other site, not your usernames or passwords. It has no access to the content of tabs or pages, and injects no script, but in Firefox, on Vintarget's own pages: a short script that only carries Vintarget's messages to the extension and its answers back (Firefox gives a site no other way to talk to an extension). It reads nothing of the page. This access to Vintarget's pages, which Firefox lists at install ("Access your data for vintarget.fr"), would in principle also put Vintarget's cookies, your Vintarget session among them, within the extension's reach: it asks for none, and when Firefox tells it they changed, it ignores that without reading them.

The data received from VintargetCopy Anchor Link

When you open Vintarget in this browser, Vintarget's page gives the extension the list of your organization's Vinted accounts: the organization's name, and for each account its username, photo, state and Vinted identifier. It only serves to show them to you in the extension. Vintarget's theme (light or dark) comes with it, for the extension to look the same.

• This list is kept in the browser's memory (chrome.storage.session), and erased:
  • when you sign out of Vintarget, delete your Vintarget account or leave the organization;
  • when your Vintarget session has lapsed (Vintarget sends you back to sign-in);
  • when you close the browser.
• After 12 hours without Vintarget giving it again, it is no longer shown or used, and the extension erases it as soon as it next starts up, at the latest the next time you open it (and in any case when the browser closes).
• When you switch organizations in Vintarget, the previous one's list is erased before the new one's arrives.
• The accounts' photos load from Vinted's image servers (*.vinted.net), as on vinted.fr.
• No Vintarget session or token is given to the extension: it never contacts Vintarget's server.
• The extension also keeps, in the same memory, the address of the Vintarget tabs that talk to it (Vintarget's page, never another), so that Manage accounts brings one of them forward instead of opening another: Vintarget's page tells the extension when it opens, changes pages or comes back into view. A tab that loads a page is no longer offered until Vintarget's page tells the extension again from that tab. The last 20 at most are kept; a tab is forgotten when it closes, and all of them when the browser closes. It does not read the other tabs.

The history of this profile's accountsCopy Anchor Link

To warn you when one browser profile is used for several Vinted accounts (Vinted can link them, see One Vinted account per browser profile), the extension remembers the Vinted accounts it saw in this profile.

• For each account: its Vinted user number and the date it first saw it. Never a session, a token or a password.
• Kept on your computer, in this profile only (chrome.storage.local), even after the browser closes. It is handed to no one, neither Vintarget nor Vinted, and is not synced across your devices.
• Erased when you choose Forget on the extension's "One Vinted account, one browser profile" page, which its options always open (right-click its icon, then Options; in Firefox, about:addons › Vintarget Connect › Options; in Safari, Settings › Extensions › Vintarget Connect › Settings), or Forget the other accounts in its warning. The account signed in to Vinted at that moment stays, since the extension would see it again at once. Uninstalling the extension erases everything.

When, and to whom, it is handed overCopy Anchor Link

• The session is handed over only when you click Connect (or Reconnect) in Vintarget, then confirm in the extension, which opens under its icon and shows the site asking. Vintarget's page cannot confirm for you.
• The session handed over is that of the account shown when you confirm, read at that moment: if the browser switched Vinted accounts meanwhile, nothing is handed over.
• After a refusal (or a request left unanswered), the extension no longer opens by itself for a while: 30 seconds, then twice as long at each new refusal, up to 8 minutes. A request then waits under its icon, marked “1”, until you open it yourself. So a page cannot put it in front of you in a loop.
• It is handed only to Vintarget's page, the only one allowed to talk to the extension. Vintarget then sends it to its own server, with your usual Vintarget session.
• The extension's toolbar button shows whether a session is there, and your accounts; it hands nothing over.

What it changesCopy Anchor Link

It removes no cookie and never signs you out of Vinted.

When your browser is signed in to no Vinted account and you choose Sign in to vinted.fr (or Reconnect for an account of this profile), it opens vinted.fr in a tab, then, once you are signed in, sends that tab to Vintarget.

Add another account opens a page of the extension in a tab: the steps to create a browser profile, and the history above.

When you click Manage accounts in the extension, it brings a Vintarget tab already open forward (one on that organization first) and takes it to the accounts page, rather than opening a new one. Open Vintarget, while the extension does not have the list yet, brings the Vintarget tab used last forward, without changing its page. With no Vintarget tab known, a new tab opens.

It touches no other cookie and no other site.

Why, and on what legal basisCopy Anchor Link

Vintarget uses the session to act on Vinted for your organization, as you ask it to: check the account, buy, make offers, read messages.

Legal basis: performance of the contract (GDPR article 6.1.b). You ask to connect this Vinted account so that Vintarget acts with it.

The session is never sold nor shared with third parties other than the processors below, nor used for advertising or profiling.

ProcessorsCopy Anchor Link

They process the session on Vintarget's behalf, and only to run the service:

• the host of Vintarget's server and database, where the session is stored encrypted: TO BE COMPLETED: name, hosting country;
• the proxy provider through which Vintarget's requests to Vinted, which carry the session, go: TO BE COMPLETED: name, country.

RetentionCopy Anchor Link

The session is stored encrypted on Vintarget's server and never shown again. It is kept as long as the Vinted account is connected to the organization:

• a reconnection replaces the old session with the new one;
• it is deleted when the Vinted account is removed from the organization, or when the organization is deleted.

The database's backups may still hold the session, still encrypted, after its deletion, until they are erased themselves: TO BE COMPLETED: how long backups are kept.

Vinted and automationCopy Anchor Link

Vinted's terms of use govern the automated use of an account. Vinted may restrict or suspend an account whose use it deems automated, and Vintarget cannot prevent it. Connect an account knowing this.

What the extension does not doCopy Anchor Link

• No usage statistics, no trackers, no analytics service.
• No session kept: the session stays in Vinted's cookie. The extension only keeps the list of your accounts, in memory until the browser closes at the latest and never used beyond 12 hours (erased sooner if you sign out of Vintarget), the address of the Vintarget tabs that talked to it (20 at most, forgotten when they close), the number of your recent refusals, so as not to open again by itself, and the history of this profile's accounts (Vinted user numbers and dates, until you forget it).
• No remote code: all its code is in the installed extension.

Your rightsCopy Anchor Link

You have the right to access, rectify, erase, restrict, object to and port your data. To exercise them, write to hello@vintarget.fr.

You can also, at any time:

• refuse in the extension: nothing is handed over, and it does not open again by itself for a while;
• erase the history of this profile's accounts: open the extension's options (right-click its icon, then Options; in Firefox and Safari, as above), then Forget (the account signed in to Vinted at that moment stays);
• remove an account from Vinted accounts: its session is deleted from Vintarget;
• uninstall the extension from your browser's extensions (chrome://extensions, about:addons in Firefox, Safari › Settings › Extensions): everything it kept is erased.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr), the French data protection authority.