Privacy Policy

FourCore Size Guides is a size-guide builder for Shopify. We process the minimum amount of merchant data we need to display size charts in the merchant's storefront, and we do not collect personal information about shoppers. We do not sell or share data with advertising networks. Questions: support@fourcore.dev.

Data we collect from merchants

When the app is installed by a Shopify merchant, we receive and store the following information:

• Shop identifiers — myshopify.com domain, primary domain, store name, store contact email, plan name, and whether the store is a development store. Used to scope data per merchant and to send transactional ops alerts.
• App authorization tokens — Shopify-issued OAuth offline access tokens used to make Admin API calls on the merchant's behalf.
• Product, collection, vendor and tag metadata — read from Shopify when the merchant assigns a size guide to specific products or collections, or when the storefront resolves which guide to show for a given product.
• Theme files — read-only access to config/settings_data.json so the onboarding flow can detect whether the App Embed and the size guide block are active in the live theme. We do not write theme files.
• Storefront locale list — the list of locales the merchant has enabled in Shopify Markets / Languages, used to populate the editor's translation locale picker.
• Size guide content — every size chart the merchant authors inside the app (titles, blocks, tables, images, translations, assignment rules, display settings).
• App settings — billing plan, custom code snippets, onboarding state, and per-shop preferences.

Data we receive from the storefront

When a shopper views a product page that displays a size guide, Shopify forwards the following contextual values to our app proxy so the right guide can be selected and rendered:

• Page type, product id, collection id(s), product handle, product title, vendor, product type, tags
• Selected variant title, SKU, price, compare-at-price, inventory quantity, availability
• Shopper's storefront locale and country (used for localization fallback)

We do not receive shopper names, email addresses, IP addresses (beyond what Shopify exposes to every app proxy request), payment information, browsing history, or any other personally identifying information about shoppers. We do not set tracking cookies on shopper browsers.

How we use the data

• Display size guides on storefront product pages.
• Power the in-app builder, translation flow, and analytics.
• Authenticate merchant requests via Shopify session tokens and OAuth.
• Send the merchant transactional notifications (billing, install, uninstall) and internal ops alerts to our team's Slack workspace.
• Aggregate, non-identifiable usage statistics (count of size charts created per shop, count of click-throughs on a guide) so merchants can see how their guides perform.

We do not use merchant or shopper data for advertising, profiling, or training third-party AI models.

Where data is stored

• Application data — hosted on Vercel (US regions) with a Postgres database accessed via Prisma.
• Storefront uploaded media (images used inside size guides) — uploaded directly to Shopify's CDN via the Files API and referenced by URL. We do not store image binaries on our infrastructure.
• Encryption — all traffic is served over HTTPS (TLS 1.2+). Stored credentials are encrypted at rest by the underlying provider.

Third-party services

• Shopify — the app cannot function without the Shopify Admin and Storefront APIs. Shopify privacy policy.
• Vercel — application hosting. Vercel privacy policy.
• Slack — internal operations notifications (install, uninstall, subscription changes). Only shop identifiers and event metadata are sent — never shopper data.
• DeepL / OpenAI — only used if the merchant's hosting environment configures DEEPL_API_KEY or OPENAI_API_KEY for the optional auto-translate feature. The merchant's size guide text is sent to the configured provider for translation. This is opt-in via configuration.
• Crisp — embedded support chat inside the admin panel. Identifies the merchant by shop domain so our team can answer questions in context.

Data retention and deletion

• Merchant data is retained as long as the app is installed.
• When a merchant uninstalls, Shopify sends us the app/uninstalled webhook. We then delete the shop's data from our database and cancel any active subscription record. This typically completes within minutes.
• A merchant can request earlier deletion at any time by emailing support@fourcore.dev; we'll process the request within 30 days.
• We honor Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) where applicable.

Your rights

Merchants and shoppers have the right to access, correct, and request deletion of their personal information. Because we only process merchant data (and not shopper personal data), most requests come from merchants — but we'll work with shoppers routed through their merchant if needed. Email support@fourcore.dev with the request and we'll respond within 30 days.

Depending on your jurisdiction (EU, UK, California, etc.), you may also have additional rights to lodge a complaint with your local data-protection authority.

Children

The app is intended for use by Shopify merchants. It is not directed at children under 13 (or 16 in the EU). We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. Material changes will be flagged in the app's admin UI and the "Last updated" date at the top of this page will be bumped. Continued use of the app after a change constitutes acceptance of the updated policy.

Contact

Questions, requests, or concerns:

support@fourcore.dev