Browse apps

Privacy

What each app collects, why it needs it, how long it stays, and how to have it erased.

Last updated

The short version

Appal builds apps that run inside your Shopify admin and on your storefront. Each app asks Shopify for the smallest set of permissions it can do its job with, and one of them asks for none at all. We do not sell data, we do not share it with advertisers, and we do not build profiles of your customers.

Who is responsible

Appal operates this site and the apps described on it. For data an app processes on your behalf, you are the data controller and Appal is the data processor. For this website, Appal is the controller. Contact: support@appal.io.

What each app processes

AppShopify scopesWhat it stores
Post Purchase & Upsell read_products, read_orders, checkout extension Funnel and offer settings, and per-order records of which offer was shown, accepted or declined.
Discount & Free Gift write_discounts, write_cart_transforms, read_products Your promotion rules and widget styling. No customer records.
A/B Testing & CRO read_themes, read_orders Test configuration, plus anonymous exposure and conversion events with a random visitor identifier.
Subscriptions write_products, write_purchase_options, write_own_subscription_contracts, read_customer_payment_methods, read_customers, read_orders, read_themes Your campaigns, delivery schedules and widget settings, a log of when a subscription was paused, cancelled or resumed, and the date we told our affiliate platform about the install. No shopper names, email addresses or postal addresses.
Contact Form Builder None Your form definitions, and the submissions your shoppers send you, including any attachments.

Personal data

Most of the apps never touch a shopper's personal details. The exceptions are deliberate and narrow:

  • Post Purchase & Upsell reads the buyer's name so the offer page can address them. Every such read is written to an access log recording the shop, the fields read and the reason, without the personal data itself appearing in the log line.
  • Contact Form Builder stores exactly what a shopper types into your form, because that is the product. You decide which fields to ask for.
  • Subscriptions shows you who a subscription belongs to, so it reads that shopper's name, email address and delivery address from Shopify while you have the screen open. It is rendered and discarded, never written to our database. Card details are never sent to us at all: when a shopper needs to change their card, Shopify emails them a link to a page Shopify hosts.

A/B testing uses a random identifier to keep a visitor on the same version between page loads. It is not linked to a name, an email address or an account.

What the App Store install screen says, and why

Shopify writes that screen from the permissions an app asks for, not from this page, and two of its lines surprise people. Both are worth explaining rather than leaving to look worse than they are.

  • "Store owner: name, email address, phone number, physical address." Shopify shows this for every app in its store. It is on our apps that ask for no permissions at all. We do not read it, and no app can remove the line.
  • "Device and activity data: geolocation, IP address, browser and operating system." This appears whenever an app can read orders, because a Shopify order record carries the IP and browser of the person who placed it. Subscriptions reads orders for one thing: to link a subscription back to the order that started it, which the App Store requires. A/B Testing reads them to tell which version of a page produced a sale. Neither looks at those fields, neither stores them, and the apps that cannot read orders do not show the line.

The table above is the honest answer to what we actually process. If the two ever disagree, the table is the one we hold ourselves to.

Retention

  • Configuration you create is kept while the app is installed.
  • Uninstalling triggers Shopify's shop/redact webhook. We handle it and erase the shop's data, including uploaded files.
  • Form submissions are kept until you delete them or uninstall, whichever comes first.
  • Analytics events are retained for 24 months, then deleted.

Your customers' rights

All three of Shopify's mandatory privacy webhooks are implemented and do real work rather than acknowledging and ignoring the request:

  • customers/data_request returns the data we hold for that customer so you can respond to a subject access request.
  • customers/redact deletes that customer's records.
  • shop/redact deletes everything belonging to the shop, 48 hours after uninstall as Shopify specifies.

If a customer contacts you directly, raise it through your Shopify admin and the request reaches us automatically. You can also email us.

Sub-processors

  • Shopify Inc. — the platform the apps run on.
  • Railway — application hosting and managed PostgreSQL, with volumes and backups encrypted at rest.
  • Shoffi — the affiliate platform that credits the partners who recommend our apps. When a store installs one of our apps we send Shoffi the store's .myshopify.com domain and the IP address the install came from, once, so they can match it to the referral link that was clicked. That is a merchant's IP, not a shopper's, and it is not stored by us. It applies to Subscriptions today.

That is the whole list. We do not run third-party analytics, advertising pixels or session recording inside the apps, and nothing about your shoppers is sent to any of them.

This website

appal.io is a static site. It sets no cookies, runs no analytics and embeds no third-party scripts, which is also why there is no cookie banner. Server logs kept by our host may record IP addresses for a short period for security and debugging.

Security

Traffic is served over TLS, webhook payloads are HMAC-verified, and test data is kept in a separate environment from production. More detail is on the security page.

Changes

If this policy changes materially we will update the date at the top and, for anything that affects how your data is handled, contact you before it takes effect.