Privacy Policy
Last Updated: March 2026
Introduction
StitchCraft ("we", "our", or "the App") is a Shopify application that enables merchants to offer text and image customization on their products. This Privacy Policy explains how we collect, use, store, and protect information when you use our application.
This policy applies to:
Merchants who install and use StitchCraft on their Shopify stores
Customers who interact with the customization widget on merchant storefronts
Information We Collect
From Merchants
When you install StitchCraft, we collect and store the following information:
Shopify Store URL
Identify your store and associate settings
Store Settings
Widget configuration, default prices, character limits
Font Files
Custom fonts you upload for customization options
Overlay Images
Pre-made graphics (PNG/SVG) you upload for image customization zones
Color Configurations
Thread colors and optional texture images
Product Configurations
Which products have customization enabled and their settings
Subscription Information
Your billing plan and usage (order counts)
From Customers
When customers use the customization feature on a merchant's store, we collect:
Customization Text
The text customers enter for product personalization
Image Selections
Which overlay images customers choose for image customization zones
Font/Color Selections
Which options customers choose for their customization
Order Reference
Shopify order ID to link customization details to orders
Important: We do not collect customer names, email addresses, shipping addresses, or payment information. This data remains solely within Shopify's systems.
How We Use Your Information
Merchant Data
We use merchant information to:
Provide the customization service on your Shopify store
Display the customization widget with your configured fonts and colors
Track subscription usage against plan limits
Process billing through Shopify's Billing API
Customer Data
We use customer customization data to:
Display the customized text and image preview on product pages
Store customization details with orders so merchants can fulfill custom orders
Generate preview images showing the customization
Data Storage and Security
Where Data is Stored
Store settings, product configs, orders
PostgreSQL database hosted on Fly.io (US region)
Font files and images
Shopify Files API (Shopify CDN)
Session data
PostgreSQL database hosted on Fly.io
Security Measures
We implement the following security measures:
Encryption in Transit: All data transmitted uses TLS/SSL encryption
Secure Authentication: We use Shopify's OAuth 2.0 for merchant authentication
App Proxy Validation: All storefront API requests are validated using HMAC signatures
Session Encryption: Session tokens are encrypted at rest using AES-256-GCM
Access Controls: Data is isolated per store; merchants can only access their own data
Data Retention
Active Merchants
While your StitchCraft subscription is active:
Store settings, fonts, colors, and product configurations are retained
Order customization records are retained for your reference
After Uninstallation
When you uninstall StitchCraft:
Your data is retained for 48 hours to allow for reinstallation
After 48 hours, Shopify sends a
shop/redactwebhookUpon receiving this webhook, we permanently delete:
All store settings
All fonts, overlay images, and color configurations
All product configurations
All order records
All session data
Data Sharing
Third Parties We Use
Shopify
Platform integration, billing
Store URL, subscription data
Fly.io
Application and database hosting
All app data (encrypted)
What We Never Do
We never sell your data to third parties
We never share customer customization data with other merchants
We never use your data for advertising or marketing purposes
We never access customer payment or personal contact information
Your Rights (GDPR & Privacy Laws)
Merchants
You have the right to:
Access: View all data we store about your shop (visible in the app)
Rectify: Update your settings at any time through the app
Delete: Uninstall the app to trigger automatic data deletion
Export: Contact us to request a data export
Customers
Customers who have used the customization feature have the right to:
Access: Request their customization data through the merchant
Delete: Request deletion of their customization records
When we receive a customer data request from Shopify (customers/data_request or customers/redact webhook), we:
Identify all customization records associated with the customer's orders
For data requests: Provide a summary to the merchant
For deletion requests: Redact or delete the customization text from order records
Cookies and Tracking
StitchCraft does not use cookies for tracking purposes. We use:
Shopify Session Tokens: For secure merchant authentication (required for embedded apps)
Local Storage: Optionally, for widget state on the storefront (e.g., debug mode)
We do not use any third-party analytics or tracking services.
Children's Privacy
StitchCraft is a business application intended for use by merchants (adults). We do not knowingly collect information from children under 13. The customization widget on storefronts may be used by customers of any age, but we only collect the customization text they enter, not personal information.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes:
We will update the "Last Updated" date at the top
For significant changes, we will notify merchants through the app or email
Contact Us
If you have questions about this Privacy Policy or your data, please contact us:
Contact us through the StitchCraft app in your Shopify admin.
For data-related requests, please include your Shopify store URL so we can locate your information.
Shopify App Store Compliance
This app complies with:
GDPR (General Data Protection Regulation)
CCPA (California Consumer Privacy Act)
We subscribe to all mandatory Shopify compliance webhooks:
customers/data_request- Handle customer data access requestscustomers/redact- Handle customer data deletion requestsshop/redact- Handle shop data deletion after uninstallation
Last updated