Privacy policy

Would You Swipe It for Shopify · updated 1 November 2026

Who operates the app

Zarko Stefanov
Sofia, Bulgaria
wouldyouswipeit@gmail.com

What the app does

The app lets shoppers discover a store's products with swipe cards, switch to the store's grid, select product variants and add products to Shopify's cart. Shopify handles checkout and payments.

Store and installation data

Our backend keeps the shop domain, installation status, Shopify access and refresh tokens, app subscription verification and technical compliance records. Tokens are used only on the server to access the installed store. We request the read_orders scope for merchant-only aggregate reports and the read_customers scope to read customer IDs attached to those orders. Shopify makes orders from the last 60 days available to read_orders. The server temporarily reads order IDs, dates, product handles, quantities, line totals and the customer ID when present. It uses the ID only in memory to compare an order with that logged-in customer’s consented Swipe likes or add-to-bag actions; the order data is held in a five-minute in-process cache and is not stored in our database. We do not read customer names, email addresses, phone numbers or postal addresses. Shopify must approve this protected customer data level 1 access, and existing installs must approve the added scope. The customer scope is also used for the shopper's own saved Swipe items described below.

Shopper preferences

For visitors who are not logged in, likes, size and taste preferences are stored only on the shopper's device when Shopify's Customer Privacy API permits preferences processing. For logged-in customers, saved likes are also kept on that customer's own record in the merchant's Shopify store (an app-owned customer metafield) so they appear on every device; size and taste are added only when preferences processing is permitted. No name, email, phone or address is read. The data is deleted when the merchant erases the customer (customers/redact). Choosing Swipe or Grid remembers that functional view preference. Clearing the browser's site data removes the device copy. The app does not create tracking cookies.

Optional feedback

Feedback collection is off by default. When a merchant enables it and Shopify permits analytics processing, the app sends product views, likes, skips, add-to-bag actions, skip reasons and voluntarily submitted comments through the store's signed app proxy. Records include product and collection handles, coarse device class and event time. Random event, batch and page-visit identifiers prevent duplicate counts and group one page visit; they are generated in memory for that page only and do not identify a visitor across visits. If the shopper is logged in to the store, Shopify passes their customer ID to the app through the signed app proxy and it is stored with that feedback, so the merchant can open the customer in Shopify admin. Feedback never includes names, email addresses, phone numbers, IP addresses, full page URLs or cross-store profiles. When the merchant erases a customer (customers/redact), that customer ID is removed from stored feedback.

Feedback is stored as private app-owned metaobjects in that merchant's Shopify store and is accessible in the app report and CSV export. It is not copied into our database. Please do not include personal details in comments. Common email addresses, phone numbers and links are removed automatically, but free text can still contain personal details. Contact the merchant or our support to request removal of a comment.

Retention and deletion

The maintenance service schedules removal of feedback older than 90 days. Processing time depends on Shopify availability and traffic. Merchants can delete all feedback in the app. Shopify manages cleanup of app-owned data after uninstall. Our local access tokens are removed upon uninstall; the shop record is deleted when Shopify sends its shop deletion webhook. Encrypted infrastructure backups are kept for up to 30 days and are not used to restore deleted shop data into service.

Merchant contact and app emails

When a store installs the app we read the store owner's email address and the store name from Shopify (the owner contact Shopify provides to apps). We use them only to send service emails about the app: a welcome and setup guide, a setup reminder, subscription status notices, a goodbye after uninstall and, only if the merchant turns it on, a weekly feedback report. We do not send marketing for other products or share the address. Every email has a one-click unsubscribe link. Emails are delivered by Resend, Inc. (email delivery provider). Resend stores email content and delivery data in the United States; an EU sending region does not change that storage location. Its data processing agreement includes Standard Contractual Clauses for international transfers. We keep a log of which email was sent when (no content) for up to 180 days; the address is deleted with the store's data on Shopify's shop deletion webhook. Messages sent through the in-app contact form are stored in our database for up to 365 days and delivered to our support inbox. Copies in the inbox and at the email provider are subject to their own retention and deletion procedures.

Early Access waitlist

If you join the Would You Swipe It Early Access list, we store your email address, company name, registered seat, business address and business activity, as well as the consent wording version and time, signup source and signup time, in our app database hosted in Finland. We use this information only to assess fit for Early Access and contact you about launch. Joining is optional; the form requires your separate consent. We do not sell or share the address with advertising networks. You can withdraw consent and request deletion by emailing wouldyouswipeit@gmail.com. Waitlist records are removed when a deletion request is completed. Encrypted infrastructure backups may retain deleted records for up to 30 days.

Processing and recipients

Shopify hosts the storefront assets, product catalog, cart, billing and feedback records. A small backend operated by us handles installation, administration, signed feedback forwarding and maintenance. It runs on a server rented from Hetzner Online GmbH in Helsinki, Finland (European Union); backups are encrypted on that server before any copy is stored off-site, so the backup storage provider cannot read them. We do not sell shopper data or use it to advertise outside the merchant's store.

Choices and rights

Use the store's privacy settings to grant or withdraw analytics and preferences consent. Withdrawal stops subsequent collection. Existing data is removed according to the retention policy or by a merchant deletion request. For access, deletion or a concern about processing, contact wouldyouswipeit@gmail.com. Merchants remain responsible for their own storefront privacy notices and consent configuration. See also our terms of service.