How AssetView Sidecar operates
AssetView Sidecar is a Chrome extension that adds order and payment details to transactions already in your AssetView portfolio. This page explains how it works: what it reads and when, what it keeps in your browser, what it sends, and how to turn it off. How AssetView handles your information in general is in the AssetView Privacy Policy.
In short
- Sidecar reads only the sites you turn on, Amazon.com and Venmo, and only when you approve a request or have chosen Always for that site.
- It reads in your own browser, where you are already signed in. It never sees your passwords.
- Only the purchases and payments that match what you asked about leave your browser, and they are encrypted first. Only your own AssetView, unlocked, can open them. AssetView's servers cannot.
- It never buys anything, sends money or changes your accounts, and it does not change your AssetView records. You review what it finds.
When it reads
Sidecar reads a site only when both of these are true:
- You turned the site on. In Sidecar's Work card you turn on Amazon or Venmo, and Chrome asks you to allow that one site: www.amazon.com or account.venmo.com. Until then Sidecar cannot open the site, and AssetView does not ask it about that site.
- You approved the request. When AssetView asks about a transaction, the request waits in Sidecar's Work list until you press Approve. If you chose Always for a site, Sidecar starts that site's searches by itself, in that browser, while its panel is open. You can turn Always off in the Work menu.
What it reads
On Amazon, two kinds of page and nothing else:
- Your Payments. For each charge listed: the date, the amount, whether it is a charge or a refund, the card label as Amazon shows it (for example the card type and its last four digits), the order number and the merchant line. To reach older charges, Sidecar presses Amazon's "Next Page" button, up to 12 pages back. While it does, a banner in that tab says so, and you can stop it from Sidecar's panel.
- The order page of a matching charge. The order number and the items: name, quantity and price.
On Venmo, Sidecar opens your statement page and asks Venmo for the statement of each month it needs: the same file Venmo's Download button gives you. It clicks nothing and types nothing. From the statement it keeps only completed payments you sent, and of those only the payment id, the date, the amount, the recipient's name, the note and the name of the funding source. Everything else in the statement is dropped in your browser.
From AssetView, Sidecar reads the requests meant for it. Each names the transactions you asked about by a reference, the date, the amount and the payee as your bank shows it.
How it knows where to look
For each site, AssetView publishes a short, signed description: the site, the addresses of the pages to open, and where on a page or in a statement each detail is. Sidecar checks AssetView's signature with a key built into the extension, and uses only descriptions that pass. A description is data, not a program. It cannot give Sidecar a button to press or anything to type, and it cannot reach a site you have not turned on. The one button Sidecar can press, Amazon's "Next Page", is built into the extension. A new site always needs a new version of the extension from the Chrome Web Store, and you still have to turn it on.
What leaves your browser
Answers to what you asked, and nothing else. When a purchase or payment matches a transaction you asked about, Sidecar sends:
- For an Amazon purchase: whether it is a charge or a refund, its date, amount and card label, the order number and a link to the order page when there is one, and the items (name, quantity and amount) when the order page could be read.
- For a Venmo payment: its date and amount, the payment id, the recipient's name, the note and the name of the funding source.
Each answer also says which site and which request it is for, the dates it covers, and a short reason when something could not be read. Sidecar encrypts every answer in your browser before it sends it, to a key that only your AssetView holds. Charges and payments that match nothing you asked about are not sent and not kept.
What else Sidecar talks to:
- The site itself, as your browser does when you use it: Sidecar's tabs load Amazon's or Venmo's own pages, with your own signed-in session.
- AssetView's sign-in service (clerk.assetview.com), to sign you in and keep you signed in.
- AssetView, to receive requests and deliver answers. When you pair Sidecar, it sends a short label for your browser so you can tell your browsers apart in your list of companions: the browser's name, the operating system, and a number worked out from the browser's identification string, its language, and the screen's size and color depth. While it is paired and its panel is open, it lets AssetView know it is available and which sites it can answer for, encrypted to your key.
- A notification service, a hosted messaging provider AssetView uses to tell Sidecar that there is new work. Sidecar receives notices over it and sends nothing through it. Like any service your browser connects to, it sees your IP address and connection times, never your purchase or payment details.
If a site changes and Sidecar cannot read a page, you can choose "Report a problem". The report names the site, which kind of page and which parts could not be read, and Sidecar's version. Nothing from the page is in it.
What it keeps in your browser
- Your sign-in, so you stay signed in, until you sign out or remove the extension.
- Your pairing, encrypted, until you unpair, pair again or remove the extension. After you restart your browser, Sidecar waits until AssetView is open and unlocked in the same browser.
- Its work, encrypted with the pairing: the requests it is working on, a record of what it already answered so it never answers twice, and answers waiting to be delivered. These go when you unpair.
- Your choices: which sites are on, Always, and a snooze.
- A log of its last hundred steps, for the browser session only. It holds counts, months and dates: no amounts, names or order numbers.
What Sidecar reads from a site is held only in memory while its panel is open. It is never written to your browser's storage in readable form.
Who can see what it finds
What Sidecar sends is encrypted in your browser, and only the AssetView app, unlocked with your account, can open it to show it in your portfolio. AssetView's servers store and deliver it encrypted and cannot read it, so AssetView does not look at it, use it for anything else, sell it or share it.
What it never does
- It never reads or stores a password, at AssetView or at any site, and it does not read cookies. You sign in to AssetView on AssetView's own page.
- It reads only the sites you turned on, and only what this page describes. It does not read your browsing history, your other tabs or your location.
- It does not read your name or your delivery address from Amazon. It sees a card only by the label Amazon shows.
- It never places an order, sends money or changes anything in your Amazon or Venmo account. The only button it presses anywhere is Amazon's "Next Page".
- It does not create or change anything in your AssetView records. What it finds is for you to review.
- It has no advertising and no analytics, and it runs no code from outside the extension.
How to turn it off
- Turn a site off in Sidecar's Work menu. Sidecar gives that site's access back to Chrome, and AssetView stops asking it about that site.
- Turn Always off in the Work menu.
- Unpair in Sidecar's Account menu. AssetView stops sharing with that Sidecar, and Sidecar forgets the pairing and its work.
- Remove it in AssetView, under Vault, then Companions. This works even when you no longer have the browser it was in.
- Sign out in Sidecar's Account menu. This ends the sign-in in that browser; it does not end the pairing.
- Take away a site's access in Chrome's extension settings. Sidecar cannot read that site until you allow it again.
- Remove the extension. Chrome deletes what Sidecar kept. Unpair first, or remove it in AssetView afterwards, so the pairing ends too.
Details Sidecar already sent stay in your portfolio with the rest of your records.