We record where you go,
not what you write.

PDD collects browsing data through the Envoy browser extension, which you install and control, and only after you consent. What is recorded is the shape of your activity: the sites and pages you visit, domains, timestamps, and how you engage with a page, such as scrolling, clicks, and video watched.

This is a map of where you went, kept per person in a browsing ledger on our servers, for as long as your account exists. You can pause collection at any time.

Envoy records where you go, not what you write. We do not store typed text, the contents of your searches, form entries, or anything you author. Search terms are stripped from addresses at the point of capture, so a query you type never reaches our servers.

Messaging is in-house only. There is no email, and PDD does not capture or store correspondence you have with anyone outside PDD. The record is a map of your activity, never a copy of your communications.

Collection, storage, and sharing are three separate actions, each under your control. Nothing is shared with any organisation unless you explicitly offer it for sale through a signed contract. You see the exact data before it is sent, you set the price, and you can cancel before delivery. An organisation receives only what you approved, and nothing more.

We use no cookies, no analytics, no tracking pixels, and no advertising infrastructure of any kind. PDD does not participate in the system it was built to replace.

You can delete your account at any time, and you can download all of your data first. Deletion completes once any open contract has cancelled or settled, and then the server destroys your browsing history, folders, messages, and identity records.

A small set of records is kept, and we say exactly what and why. Settlement records and the contracts they settled are kept as proof an agreement existed and was honoured, for accounting, tax, dispute, and audit. They do not contain your browsing data. The link between your account and your Stripe payout account is kept because Stripe carries its own legal retention obligations. These kept records still carry account and payout identifiers; they are not anonymised, and we will not describe them as if they were. For the full account, see Your Rights.