This policy explains what Atomi Design LLC ("Shopbird", "we") collects when merchants use the Shopbird app for Shopify and when anyone visits shopbird.app, what we do with it, and the choices you have. Shopbird only uses data to run the app for the store that installed it. We don't sell data, and we don't use it for advertising.
Who this covers
- Merchants: Shopify stores that install Shopbird, and their staff.
- Shoppers: customers of those stores whose visits pass through a Shopbird lock, drop or raffle. For shoppers, the store is in charge of their data and Shopbird processes it on the store's behalf. Shoppers with questions should contact the store first.
- Visitors to shopbird.app.
What we collect from merchants
When a store installs Shopbird, Shopify gives the app access to the data it needs to work:
- Store details: the store's domain and settings, and the name and email of the staff member signed in to the app.
- Catalog and content: products, variants, collections, inventory, pages, blogs and themes, so Shopbird can lock them and check the theme is set up.
- Customers and orders: customer tags and order details, used by unlock rules, drops and made-to-order sales.
- What you set up in Shopbird: locks, audiences, codes, drops, messages, API tokens and webhook endpoints.
What we collect about shoppers
- Customer IDs and tags, to check whether a signed-in customer can unlock, and to add tags when the store chooses to tag customers who unlock.
- Raffle entries: the customer ID and email of each entrant, so winners can be drawn and told.
- Code redemptions: which customer used a single-use or once-per-customer code.
- Email lists: when a store syncs a list of emails for an unlock rule, Shopbird keeps only a keyed hash of each address, not the address itself.
- IP address: used at the moment a shopper unlocks, to apply location or IP rules and to limit abuse. Locations are looked up in a MaxMind GeoLite2 database stored on our own servers, so the address isn't sent anywhere else, and Shopbird doesn't store it.
- Unlock tokens: after unlocking, the shopper's browser holds a signed token that lets checkout confirm access. It records which lock and code opened it and when it expires.
Shopbird reads customer email addresses only after Shopify approves the app for protected customer data, and only for features that need them.
Who else processes data
- Shopify, which hosts the store and passes data to the app.
- Fly.io, which hosts the Shopbird app and its database.
- Resend, which sends raffle result emails when a store has Shopbird email its entrants.
- Klaviyo and Mailchimp, only when a store connects them. Shopbird checks list membership and adds shoppers who subscribe while unlocking. Connection keys are encrypted at rest.
- Google, only when a store shares a Google Sheet as a code or email list.
- Endpoints the store adds for webhooks. Shopbird signs every delivery so the receiver can verify it.
How long we keep it
- API request logs are kept for 30 days. Idempotency keys are kept for 24 hours.
- When a store uninstalls Shopbird, Shopify tells us 48 hours later, and we delete that store's data.
- When Shopify passes on a shopper's request to erase their data, we delete their raffle entries and code redemptions for that store.
- Everything else is kept while the store has Shopbird installed.
Your rights
Depending on where you live, you may have the right to see, correct, delete or move your data, or to object to how it's used. Merchants can email us at support@shopbird.app. Shoppers should ask the store they bought from, and Shopbird responds to the requests Shopify forwards on the store's behalf.
Security
API tokens are stored only as hashes. Integration keys are encrypted. Unlock tokens and webhooks are signed with HMAC-SHA256 using secrets unique to each store.
shopbird.app
This website sets no cookies and runs no analytics. It loads fonts from Google Fonts, so Google receives your IP address when the page loads.
Changes and contact
If we change this policy, we'll update the date at the top, and we'll tell merchants in the app about significant changes. Questions: support@shopbird.app, or Atomi Design LLC, PO Box 2787, Telluride, CO 81435.