Privacy Policy

Last updated: July 10, 2026

This policy explains what the Truestock Options & Bundles app (“the App”) stores when a merchant installs it on their Shopify store, why it’s stored, and how to have it removed.

What the App stores

• Store record — your .myshopify.com domain, store name and currency, and the Shopify access tokens the App uses to call the Shopify API on your behalf. Tokens are encrypted at rest (AES-256-GCM).
• Your configuration — the option sets, choices, conditional rules, bundles and components you create, plus the Shopify product and variant identifiers you assign them to. This is store catalog configuration, not personal data.
• Webhook records — Shopify sends the App notifications (for example, when the App is uninstalled, or for privacy requests). These are recorded so each notification is processed only once. Privacy-related notifications can include Shopify customer and order identifiers.

What the App does not do

• It does not store your customers’ names, email addresses, or payment details.
• It does not process payments, and it does not alter Shopify checkout.
• It does not sell, rent, or share your data with third parties for advertising.
• It does not track shoppers across sites or use advertising cookies.

Options a shopper selects (for example, engraving text) travel with their cart as Shopify line item properties and are stored by Shopify on the order — not in the App’s database.

Service providers

The App runs on infrastructure operated by:

• Vercel — application hosting.
• Supabase — database hosting.

Both process data solely to run the App. Data is stored in the United States.

Retention and deletion

When you uninstall the App, its access to your store ends immediately and the store record is marked inactive. The App supports Shopify’s mandatory privacy webhooks: on a shop erasure request the store’s data is removed, and on a customer erasure request any records associated with the identified orders are removed.

To request deletion or a copy of your data at any time, email joewcarson@gmail.com. Requests are actioned within 30 days.

Changes and contact

If this policy changes materially, the date above is updated and the change is described here. Questions or privacy requests: joewcarson@gmail.com.