Privacy policy
Effective 2 October 2026. Operator: Fritz Döbel, Albert-Einstein-Str. 47, 02977 Hoyerswerda, Germany. Contact: fritzdoebel@gmail.com.
Data used to provide the app
The app reads product variants, native bundle component relationships, tracking policies, available stock and stock locations. It does not request customer names, email addresses, postal addresses or payment details. Reports are processed on demand and returned to your browser.
Storage and hosting
Shopify access tokens are encrypted in a private SQLite-backed Cloudflare Durable Object dedicated to this app and restricted to the European Union. The store also retains the shop domain, dates of meaningful use, and review prompt dismissal preference. Reports and scan counts are not stored in the persistent data store. Scan progress stays in memory in the current browser tab. Downloaded CSVs and printed reports remain under your control.
Hosting is provided by Cloudflare Workers and Durable Objects. The previous Netlify deployment and encrypted store may be retained temporarily during migration and rollback verification. Shopify provides app authentication and the Admin API. These providers may process data outside the EEA under their applicable data protection arrangements. We do not sell data or use advertising trackers. Hosting providers may retain technical logs; the app avoids logging token-bearing request URLs and report contents.
Purposes and retention
We process this information to deliver the app requested by the merchant and protect its operation, under GDPR Articles 6(1)(b) and 6(1)(f), as applicable. Usage dates support an optional review prompt after repeated use. Dismissing the prompt permanently stops requests for that installation. Uninstall and Shopify shop-redaction notifications delete stored sessions and usage records. Provider retention follows the applicable hosting provider’s storage policies.
Cloudflare’s SQLite point-in-time recovery can retain earlier database states for up to 30 days. The front Worker and provider metadata may process data outside the European Union. Deleted shop records must be removed before any recovery is put back into service.
Your rights
Contact the operator to request access, correction, deletion, restriction, portability or to object where applicable. You can also complain to a supervisory authority, including the Saxon data protection authority. For support, please send only the minimum information needed and omit customer details and credentials. Support correspondence is retained to resolve the issue and deleted when no longer needed.