TillKit Checkout Rules lets a Shopify store block checkout, change its delivery options or change its payment methods by postcode. This page covers what the app keeps, where and for how long.
The app never stores your customers' details. It asks Shopify for two permissions at install, to manage checkout validation and delivery customisation, and a third, to manage payment customisation, only if you save a payment rule and agree to it. None of them gives it access to your orders, customers or product catalogue; at checkout it sees only the items in that cart.
While the app is installed we keep two kinds of record about your store, both in the app's database on Cloudflare and both deleted as soon as you uninstall.
The first is your store's myshopify address and the sign-in key Shopify gives the app when you install it, which is an access token, a refresh token, their expiry times and the permissions granted. The key lets the app save your rules when you use it, and in a daily check when your plan or one of the app's ready-made lists changes, and it only covers the permissions above.
The second is a usage record: the day the app first saw your store, whether it's a development store, your store's country, the plan you're on and when we last checked it, how many active rules you have of each type, how many of those use an international postal code and for which countries, the day you first saved more rules than your plan allows and how many of each type that save held, and the first country you picked that has no ready-made list yet, with the day you picked it. We use it to apply your plan's rule limit and to see which plans, countries and lists stores actually use, so we know what to build next. While a save is running we also hold a short lock with your store's address, so two saves can't overwrite each other, and when a plan change has to wait for your billing cycle to end, or a scheduled update fails, we keep your store's address and Shopify id until it's done.
We also keep monthly counts with no store named in them: installs, uninstalls and requests for a country with no list, by store country, and uninstalls by plan and by whether the store had gone over its rule limit. They hold no store address or id and aren't deleted when you uninstall.
Your rules are saved in your own Shopify store, not by us.
We don't keep any. At checkout the app's Shopify Functions run on Shopify's servers and read the delivery postcode, address lines and country, the items in the cart, the cart total, the shopper's language, the delivery options and, for payment rules, the payment methods on offer. They use the postcode and country to match your areas and the address lines to spot a PO box, and they keep nothing. No orders, addresses or payment details reach us.
Shopify sends every app its customer data request and customer deletion notices, which include a customer's id, email and phone number. We check them in memory and drop them without storing or logging anything, as we hold nothing to return or delete.
We don't keep request logs. The app's own short logs hold your store's domain, when it installs, uninstalls or saves rules (with how many), the plan read from Shopify, its permission changes and any error it hits, never customer data (an error can quote the rule it stopped on), and Cloudflare keeps them for up to 7 days. When a store asks for help, we can read that store's saved rules and the app's log lines naming it to trace the problem.
We don't sell or share anything. Cloudflare hosts the app's pages and its database, and Shopify runs the checkout functions and tells us which plan your store is subscribed to.
Uninstalling, or Shopify's shop data deletion request, adds one to that month's uninstall counts and deletes your store's sign-in, usage record, save lock and any waiting plan update straight away. The database's own 30-day recovery history drops it after that. Your rules stay in your store and we keep no copy.
Questions about this policy: hello@tillkit.app.