Privacy policy

StoreGuard is a Shopify app that compares your draft theme to your live store and checks that customers can still buy from you. This page explains exactly what data it holds, where that data sits, and how long it stays there.

The short version

StoreGuard reads your store. It never writes to it. It never reads, receives or stores data about your customers. It holds your store's settings, a record of the checks it has run, and screenshots of your own storefront pages. All of it is deleted when you uninstall the app.

Who is responsible

Felipe Sayao Studio
Ludwig-Jahn-Str. 10
47533 Kleve, Germany
hello@felipesayao.studio

We are the controller for the data described on this page within the meaning of the General Data Protection Regulation (GDPR).

What StoreGuard can access

When you install StoreGuard, Shopify asks you to approve three permissions:

• read_themes to see which themes exist and to open your draft theme for comparison
• read_products to list your products so you can choose which ones to check
• read_online_store_pages to list your pages so you can choose which ones to compare

StoreGuard requests no write permissions of any kind. It is not technically able to change a theme, a product, a price, a page or your checkout. It cannot place an order or enter payment details. Checks stop at the checkout page and go no further.

What StoreGuard stores

About your store

Your myshopify.com domain and the Shopify session that keeps you signed in. Your store's contact email address, used only as a fallback destination for alert emails if you have not set one yourself.

Your settings

The pages you chose to monitor, the products you chose to check, the change threshold you set, how often checks should run, and the email address alerts should go to.

If your store is password protected and you choose to give StoreGuard the storefront password, it is encrypted before it is written to the database using AES-256-GCM. It is decrypted only at the moment a check needs to open your store, and it is never shown back to you or included in any email.

Records of checks

For each check: when it ran, what started it, whether it passed, and what it found. For purchase checks, the steps that were completed. For visual comparisons, how much of each page looked different and which theme sections the differences came from.

Screenshots

Images of your own storefront pages, captured on your live theme and on your draft theme, plus the generated image that highlights the differences between them.

These are captured the way an anonymous visitor sees your store. StoreGuard is not signed in as a customer, has no customer session, and does not visit account pages, order pages or anything behind a customer login. If you have placed personal data on a publicly visible page of your store, for example a named testimonial, that page's screenshot will contain it in the same way a search engine's cached copy would.

What StoreGuard never stores

• No customer data. No names, email addresses, shipping addresses or phone numbers of your customers.
• No orders, no order contents, no order history.
• No payment data of any kind. StoreGuard never enters payment details and never completes a purchase.
• No analytics, advertising or tracking data. This website sets no tracking cookies and runs no analytics scripts.

Because StoreGuard holds no customer data, Shopify's mandatory customers/data_request and customers/redact requests are acknowledged with nothing to hand over and nothing to erase. The shop/redact request performs a full deletion of everything listed above.

Why we hold it, and on what legal basis

To provide the app you installed, which is a contract between us (Art. 6(1)(b) GDPR): your settings, your check records, your screenshots and your session.

To keep the service working and secure (Art. 6(1)(f) GDPR, legitimate interests): server logs, error records and rate limiting. We keep these briefly and do not use them to build a profile of you.

To answer you when you contact support (Art. 6(1)(b) and (f) GDPR): the message you send us and the address you send it from.

Where the data is

• Application server: Fly.io, Amsterdam, Netherlands
• Database: Neon, eu-central-1, Frankfurt, Germany
• Screenshot storage: Cloudflare R2, EU jurisdiction
• Email delivery: Resend

Fly.io, Cloudflare and Resend are companies based in the United States that operate the infrastructure listed above. Where any processing takes place outside the European Economic Area, it is covered by the European Commission's Standard Contractual Clauses under the data processing agreement we hold with each provider.

Shopify itself is a processor for your store data under your own agreement with Shopify, not ours.

We use no other processors. No advertising networks, no analytics providers, no AI services.

How long it is kept

Check records and screenshots are deleted automatically once they pass the retention window of your plan:

• Free: 7 days
• Pro: 30 days
• Studio: 90 days

A background process removes them along with the stored images. Nothing is retained beyond the window, and there is no archive.

Your settings and your encrypted storefront password are kept for as long as the app is installed.

When you uninstall StoreGuard, everything is deleted immediately: every check record, every screenshot, your settings, your stored password and your session. This runs automatically on Shopify's app/uninstalled notification and again on shop/redact. It is not reversible and there is no backup you can be restored from.

Your rights

You have the right to access the data we hold about you, to have it corrected, to have it deleted, to restrict or object to its processing, and to receive it in a portable form. To exercise any of these, write to hello@felipesayao.studio. We will respond within one month.

The fastest route to deletion is to uninstall the app, which wipes everything immediately and without a request.

You also have the right to complain to a supervisory authority. Ours is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

This website

storeguard.fly.dev sets no tracking cookies, runs no analytics and embeds no third-party scripts. If you sign in through the form on the home page, your store domain is used solely to send you to Shopify's authorisation screen. If you use the support form, the message you write and the address you give are sent to us by email and are not stored on this website.

Changes to this policy

If we change how StoreGuard handles data, this page is updated and the date at the top changes with it. Material changes are announced inside the app before they take effect.