We keep as little as we can, and guard the rest.
How Playbuy protects merchant data, what we never collect, and how fast we delete it when you leave.
Encrypted credentials
Shopify access and refresh tokens and social account tokens are encrypted at rest with AES-256-GCM, and access tokens expire hourly.
No customer PII
We never store your customers' names, emails, phone numbers or addresses. Attribution uses order IDs and totals only.
Consent-aware tracking
Storefront analytics follow Shopify's Customer Privacy API. Without consent, no visitor identifier is set.
Minimal scopes
We request only the Shopify permissions the app needs: read-only product access, the web pixel for attribution, and optional read-only theme access to confirm the app embed is on.
What data we handle
| Data | Why | Retention |
|---|---|---|
| Shop details (domain, name, plan, currency) | Run the app and billing | While installed; deleted within 48h of Shopify's shop deletion request |
| Staff name and email | Dashboard login (magic links) | While the account is active |
| Product catalog subset (title, handle, image, price, variants) | Show products in widgets | Synced while installed |
| Videos and posters you upload or import | Play them on your store | Until you delete them or uninstall |
| Anonymous storefront events (views, clicks, add-to-carts) | Analytics | Raw events 30 days; daily totals while the app is installed, deleted 48 hours after uninstall |
| Order ID, total, currency and line items | Revenue attribution | While the app is installed, deleted 48 hours after uninstall |
We do not store end-customer names, emails, phone numbers, addresses or payment details.
Infrastructure
- All traffic is served over HTTPS with HSTS. The dashboard sends a strict Content Security Policy and other hardening headers.
- Shopify OAuth requests and webhooks are verified with HMAC signatures; failed checks are rejected.
- Every database query is scoped to a single shop to prevent cross-tenant access.
- Dashboard sessions use secure, HTTP-only cookies; logins use single-use, short-lived magic links.
- Storefront widgets render merchant content as text inside an isolated Shadow DOM — no custom scripts or raw CSS.
- Logs are redacted so tokens, cookies and emails are never written to them.
- Our hosting and service providers are listed on the subprocessors page.
GDPR and Shopify compliance webhooks
We implement Shopify's mandatory privacy webhooks:
- customers/data_request — we hold no customer-identifying data, and we confirm this in response to each request.
- customers/redact — any anonymous records linked to the customer's orders are removed.
- shop/redact — all of the shop's data is deleted within 48 hours, including videos, events and analytics.
When you uninstall, your tokens and sessions are deleted immediately, your widgets stop serving and Shopify cancels your subscription. See our privacy policy and DPA for details.
Responsible disclosure
If you believe you have found a security vulnerability, please email security@playbuy.app with steps to reproduce. We will acknowledge your report, keep you updated, and credit you if you wish. Please give us reasonable time to fix the issue before public disclosure, and do not access other merchants' data, degrade service, or run automated scans against stores. Our security.txt is published per RFC 9116.
- Good-faith research is welcome.
- We won't pursue legal action for good-faith reports that follow this policy.