PewterPewter: Tag Lock
Privacy Policy
Pewter: Tag Lock ("Tag Lock", "the app") is a Shopify app operated by Jackson Rowley, doing business as Pewter ("Pewter", "we", "us"). This policy explains what the app collects when a merchant installs it, how that information is used, and how long it's kept.
The short version
- We don't store any personal data about your store's customers.
- We store your store's lock settings, billing status, and the name and email of staff who open the app.
- We delete everything about your store within about 24 hours of you uninstalling.
Customer data
Tag Lock decides access using your customers' tags (for example wholesale). Those tags are read live: by your theme, in the shopper's browser, and by Shopify's checkout, on Shopify's servers. They are never sent to Pewter's servers and never saved by us. Tag Lock doesn't collect customer names, emails, addresses, orders or any other customer personal information.
What we collect and why
When you install Tag Lock, Shopify gives the app access to your store. We store only what's needed to run it:
| Information | Why |
|---|---|
| Your store's myshopify address | To identify your store and run the app for it |
| Your locks, keys and settings, including the IDs and handles of the products, collections and pages you lock | To build the rules your storefront and checkout apply |
| Billing status: your plan, trial and subscription state (payments are handled entirely by Shopify) | To know whether the app is active for your store |
| The name and email address of staff members who open the app, provided by Shopify at login | For login sessions, and to recognise the app owner's own staff accounts |
| Shopify access tokens | To read your catalog and save rules to your store on your behalf |
| The name of your published theme | To show whether the Tag Lock app embed is turned on |
We don't sell this information, share it for advertising, or use it for anything other than running and supporting Tag Lock.
Where it's stored
We use these service providers to run the app:
- Railway (United States): hosts the app server and its database.
- Shopify: provides your store data, handles billing, and runs the storefront and checkout parts of the app.
Your lock rules are also saved to your own store as app data (Shopify metafields), so your storefront and checkout can apply them without contacting our servers.
How long we keep it
- Staff login sessions are deleted as soon as you uninstall the app.
- All other store data (locks, keys, settings, billing status) is deleted about 24 hours after you uninstall. The short delay lets you reinstall without losing your setup. If Shopify sends us a store deletion request (
shop/redact), we delete everything at that point. - Server logs record store addresses and request details for troubleshooting. They contain no customer data and are kept only for our host's limited log-retention period.
Privacy requests (GDPR and CCPA)
Shopify forwards customer privacy requests to apps. Because Tag Lock stores no customer personal data, customer data requests and deletion requests are acknowledged with nothing to return or delete. Store deletion requests are handled as described above.
Merchants and staff can ask what we hold about them, or ask us to correct or delete it, by emailing [email protected].
Cookies
Tag Lock adds no tracking or advertising cookies to your storefront. Inside Shopify admin, the app uses Shopify's own session tokens to keep you signed in. This website sets no cookies.
Security
Data is sent over HTTPS, the app server reaches its database over a private network, and access is limited to the app's operator. No system is perfectly secure, but we keep what we hold to the minimum.
Children
Tag Lock is a business tool for Shopify merchants and is not directed at children.
Changes
If this policy changes, we'll update it here and change the effective date above.
Contact
Jackson Rowley, doing business as Pewter
[email protected]