Security & Your Amazon Data
Forwarding an Amazon order to a stranger on the internet is a reasonable thing to be cautious about. Here's exactly what the goblin sees, what we keep, and how we protect it.
The short version: the goblin can't get into your Amazon account, doesn't read your inbox, and never touches your payment info. It reads only the order email you choose to forward, stores the handful of fields it needs to remind you, and locks the rest down.
What the goblin can see — and what it can't
- Sees: the order email you forward to
track@returngoblin.com(or that you tap Track this return on in the Gmail add-on). That means item titles, prices, order number, ship and delivery dates. - Doesn't see your Amazon login. No password, no two-factor codes, no access to your Amazon account. We are not Amazon and we never ask you to sign in.
- Doesn't see your payment cards. Amazon's order emails don't include full card numbers, so neither do we.
- Doesn't read your inbox. Without your forward, the goblin sees nothing. Every other message in your mailbox is invisible to us.
The optional Gmail add-on
If you install the add-on, it can read only the message you currently have open, and only while it's open. It can't browse the rest of your mailbox, and it only sends a forward when you tap Track this return. We deliberately did not request broad Gmail access. Full breakdown in the privacy policy.
What we store
Just enough to remind you, and nothing else:
- The email address you forwarded from.
- The order details we pulled out — item titles, prices, ship date, delivery date, category, and the order number.
- Which receipts and reminders we sent you, and when.
We don't keep the full raw email body in our application database. The one-tap links inside your emails — "cancel reminders", "I returned it" — use single-use tokens that are stored hashed at rest, so even a stolen copy of the database couldn't replay them.
How your data is protected
- Encrypted in transit. HTTPS for every page on our site, and TLS for the email handoff between providers.
- Locked-down database. Row-level security with a server-only key. Browsers can't read the tables, even ours — only the goblin's backend can.
- Signed inbound webhooks. Every email that lands on our server is signature-verified before we look at it.
- Double opt-in. Reminders only start after you click Confirm in your first receipt — a typo'd or wrong-address forward can't get reminders.
- Rate limits + abuse guards on the inbound pipe so no one can flood the service or impersonate you.
How we use AI
We use Anthropic (Claude) to read the structured details out of your forwarded email. The sanitized text is sent once, used only to extract the order fields, and is not used to train AI models. Before we send anything, we strip hidden/invisible characters and neutralize prompt-injection attempts so a malicious email can't trick the system.
Who else touches your data
A small set of service providers, each under contract and listed in the privacy policy — Anthropic for parsing, Resend for inbound and reminder email, Supabase for the database, Fly.io for hosting, and PostHog for privacy-friendly product analytics (page views and clicks on our site, never your order contents). We don't sell your data, and we don't use it for advertising.
Stop and delete anytime
Every receipt and reminder has a one-tap link to cancel reminders for that order. To delete your account and everything we've stored, email privacy@majr.app and we'll wipe it.
Report a security issue
Found something we should fix? Email support@returngoblin.com with "security" in the subject line and we'll get on it right away. We appreciate responsible disclosure.