Privacy policy

Who I am

I am Erik Eng, an independent developer of Shopify apps, and the data controller for both: Erik Eng, Nordanvägen 5, 146 40 Tullinge, Sweden. This policy covers:

• Option Sorter, which sorts product option values such as sizes and months.
• Fix First, which checks a Shopify store for problems and ranks them by what to fix first: a free check on the web, and an app you install.

I handle data in line with Shopify's App Requirements and applicable privacy laws, including the GDPR and the CCPA. Questions about this policy or your data: erik@eng.se.

What both apps have in common

• I do not sell data, and I share it with no one except the service providers below and where the law requires it.
• Neither app collects personal information about a store's customers.
• Both subscribe to Shopify's mandatory privacy webhooks. When a store uninstalls an app, or Shopify asks me to erase a store's data, what I hold for that store is deleted.
• Merchants see what each app can access when they install it, and can remove an app at any time from the Shopify admin.

Service providers

Both apps run on Amazon Web Services in the United States (the us-east-1 region): hosting, a database, file storage, a content delivery network and email sending, under AWS's data processing terms. Shopify provides sign-in and the store data each app reads. The pages load the Inter font from Shopify's content delivery network (cdn.shopify.com), which, like any website you load something from, sees your network address.

Your rights

You can ask what I hold about you or your store, have it corrected or deleted, and object to its use. Write to erik@eng.se. You can also complain to your data protection authority; in Sweden that is the Swedish Authority for Privacy Protection (IMY).

Option Sorter

Option Sorter keeps only what it needs to stay signed in to your store through Shopify's sign-in: a session token that lets it read and update your products' options. It holds no names, email addresses, payment details or customer information.

It reads product option values (for example sizes) and, when you ask, puts them in a natural order (S, L, M becomes S, M, L) through Shopify's API. Product data stays in your Shopify account; the app keeps no copy. The session is kept while the app is installed and deleted when you uninstall it.

Fix First: the free check

• What you give me. A store address (and optionally a preview theme link). If you ask for the report by email, an email address.
• What is read. A few public pages of that store, the same any visitor can see: its robots.txt, home page, product list, a product page, policy pages and some menu links. The visitor is called FixFirstBot; its page explains what it reads and how a store can opt out.
• The report. Each check is saved as a report (the store address and its findings, no details about you) so it has a link that can be shared. Anyone with the link can view it. Reports are deleted after 90 days, with their share images.
• The report by email. Your address is used only to send that one report, and deleted once it is sent (or after a day, if the check never finishes). No newsletter, no other email. Emails are sent with Amazon SES. To stop the email being used to mail strangers, counts are kept as one-way hashes, which cannot be turned back into an address; if an email bounces or is reported as spam, a hash of the address is kept so it is never mailed again.
• Limits. To keep the check from being misused against stores, a one-way hash of your network address is kept for two hours to count how many checks and emails you start.
• Logs. The servers log each check's store address and outcome, never your network address, and keep the logs for 90 days. The content delivery network's access logs are off.
• Cookies. None, and no analytics or advertising. The page remembers whether you chose the Merchant or Agency view in your browser's own storage, which never leaves your browser.

The legal bases: your request (to check a store and send what you asked for) and my legitimate interest in running the service and preventing abuse.

Fix First: the installed app

Fix First asks only to read your products; it cannot change your store. It keeps the session token Shopify gives it at sign-in and your store's address, and deletes them when you uninstall. It reads your product catalog to check it and shows the results; it keeps no copy of your catalog. It also asks your store's catalog for AI shopping assistants, which Shopify runs for every store, which of your products it can find; nothing from that answer is kept. When you run the full check, it reads your store's public pages the same way the free check does, and that check is saved as a report with its own link, kept for 90 days like any free check, also after you uninstall. A free check of your store run before you installed the app is shown in the app too. When you mark a finding fixed or ignored, it keeps that choice and the finding's title, and deletes them when you uninstall. If your store is password protected, you can give the app your store password to check its pages. It is used to open your store for that check and, unless you untick "Remember for future checks", kept so the next check needs nothing from you; you can forget it in the app at any time, and it is deleted when it stops working or you uninstall. That check stays in the app, with no shareable link, and is kept for 90 days or until you uninstall. Where a finding can be fixed with Option Sorter, it may mention it; Option Sorter is also made by me, and the mention never changes how findings are ranked.

How long data is kept

Changes

I may update this policy when the apps or the law change. The latest version is always at https://erikeng.se/shopify/privacy, with its effective date.