Who this covers
Mix & Match More is a public Shopify app that merchants (shops) install through Shopify. This policy describes what happens for any shop that installs it.
What we collect
From the merchant's store, the app stores a shop-level OAuth session: the shop-scoped offline access token (and its refresh token), your shop's myshopify.com domain, and the permissions you granted at install. This is how the app authenticates its calls to Shopify's Admin API on your shop's behalf. We do not collect the installing staff member's name, email, or any other personal details — the app uses offline (shop-level) tokens only.
Which storefront surfaces your shop is entitled to show is written as app-owned metafields on your shop's app installation — configuration that lives in Shopify's infrastructure, not our database, and contains no personal data. Your subscription is held by Shopify, which hosts the plan page, runs trials and charges you; the app reads it from Shopify when it needs to know your plan and keeps no copy.
If you contact us through the form on our Support page, we store what you send: your store's myshopify.com domain, the email address to reply to, the topic you picked, and your message. We use it only to answer you. It is emailed to our support inbox, and your address is used only so we can reply.
Set templates you create in the app are stored as metaobjects in your own Shopify store — Shopify hosts them, they belong to your shop, and they contain configuration (products, labels, discount settings), not personal data.
From shoppers on your storefront: nothing. The storefront component runs entirely in the shopper's browser and only calls your store's own Shopify-hosted endpoints (product data, the cart, discount codes). It does not call any endpoint of ours, sets no tracking cookies, and sends no analytics beacons. We do not collect or store customer (shopper) personal data of any kind — no names, emails, addresses, or order history.
Why we collect it
The session lets the app make authenticated Admin API calls (reading products, writing discounts) on your behalf — this is how Shopify apps work. The entitlement metafields let your storefront theme know, at render time, which surfaces your plan includes. A support request is kept so we can reply to it and see what was asked.
Where it is kept
The hosted app runs on Fly.io in Los Angeles, United States. Its database is Postgres, hosted by Prisma Data Platform. Entitlement metafields and your set-template metaobjects live in Shopify's own infrastructure, and your subscription is held by Shopify. Support requests are emailed to our support inbox through Resend, an email delivery service.
Retention
Session data and entitlement state are deleted when your shop uninstalls the app, and Shopify's mandatory shop-redact webhook triggers a second deletion pass some time after uninstall. If neither notice reaches us, a daily job deletes a shop's session once it can no longer authenticate — at most about seven days after its access and refresh tokens have expired. Support requests are deleted 180 days after you send them, or with the rest of your shop's data when Shopify's shop-redact webhook arrives, whichever is first. The email copy in our support inbox is kept as correspondence; if you ask us to erase your request, we delete it from the inbox too. Nothing shopper-related exists to retain.
The set-template metaobjects you create live in your own store and are not deleted when you uninstall — they are yours to keep or remove in Shopify admin.
Two secondary copies exist, none holding shopper data: the database provider keeps daily backups for up to seven days, and our email provider, Resend, keeps a record of each support email it delivers for its log retention period. We previously granted some shops complimentary access, and a deploy that ran a database migration archived a copy of that record (shop domain, reason, timestamps only — never session tokens) for 90 days. Complimentary access has been retired: no deploy creates these archives any more, and those that remain expire within 90 days of their creation. Server logs are not retained.
GDPR / data subject requests
Mix & Match subscribes to Shopify's three mandatory compliance webhooks. Customer data-request and customer-redact requests are recorded as no-ops, because we never collect customer (shopper) personal data — there is nothing to disclose or delete. Shop-redact deletes your shop's session data from our database. The app also receives operational shop-level webhooks (uninstall and permission updates); these carry no personal data. If you believe we hold data about you and want it reviewed or removed, contact us directly — see below — in addition to Shopify's automated flow.
Contact
Reach us through the Support page, which also lists our email address, support@mixandmatchmore.com. Include your myshopify.com domain so we can find your store.
Changes to this policy
This is a living document tied to the app's actual behavior. As new storefront surfaces or billing features ship, it will be reviewed and updated to match.