Privacy Policy

Last updated: September 9, 2026

Chalkline is a Shopify app that shows a merchant which of their customers still owe them money, how late each unpaid invoice is, and whether an account has gone past a credit limit the merchant set. This policy explains exactly what the app reads, what it stores, and what it does not touch.

What the app reads

When a merchant opens the app, it queries the Shopify Admin API for the orders that still have money owed on them:

• Order number, date, and the amount still outstanding
• Payment terms on the order: the name of the terms, when each instalment is due, and whether it has been paid
• The name of the customer or company the order belongs to, so the amount owed has somebody’s name on it

A name is the least this app can read and still do its job: a screen saying “someone owes you 4,200” helps nobody. It does not read or display email addresses, phone numbers, billing addresses, shipping addresses, what was bought, or payment card details.

What the app stores

Two things are written to the app’s database:

• The Shopify session for each installed store: the store domain, the API access token, and the granted permission scopes. This is what lets the app talk to Shopify on the merchant’s behalf.
• Credit limits the merchant sets, stored as a Shopify customer or company ID and an amount. This is the merchant’s own judgement about their own risk. It is never sent to Shopify, never shown to the customer, and never leaves the merchant’s own store.

Orders, amounts owed, payment terms, and customer names are never written to disk. They are requested from Shopify when a page loads, used to work out what is late, and discarded when the response is sent.

Retention and deletion

When a merchant uninstalls the app, Shopify sends an app/uninstalled webhook and the app deletes that store’s session and every credit limit it held for that store. Nothing else is stored, so uninstalling removes all of it.

A merchant can also request deletion at any time by emailing hjuhyun35@gmail.com.

Security

• All traffic runs over HTTPS, and the server refuses plain HTTP.
• The database is Cloudflare D1, encrypted at rest with AES-256 by the host, with the keys held by the host and not by this app. It has no public address: the app reaches it over a binding available only to this app’s own code, and nothing on the internet can address the database directly.
• The host keeps a rolling thirty-day history of the database that can be restored to any point in it. It exists so the merchant’s own settings survive a failure; it holds no customer records, because none are stored.
• Access tokens are stored server-side and are never exposed to the browser. Credentials are held in the host’s secret store, not in the source code.
• One person — the developer — can reach the server and the database, using accounts protected by unique passwords held in a password manager. Nobody else has access.
• The server records each request it serves, which is the only place a customer name is ever read. Those logs are kept by the host and hold no names themselves.
• Development and testing never use real store data. The automated tests run on invented records, and the design preview ships with invented customers.

The strongest protection here is not storing anything

Names and amounts owed are read from Shopify while a page is being drawn and are gone when the response is sent. There is no copy of a customer to leak, export, or be asked to delete. The only rows this app writes are the merchant’s own session and the credit limits the merchant typed in themselves.

If something goes wrong

If the developer finds, or is told about, a breach or a suspected one:

• The app is taken offline or its access tokens are rotated immediately, whichever stops the exposure faster. This is a deliberate trade: an app that is down is better than one that is leaking.
• The cause is established from the server logs, and the entry point is closed before the app is turned back on.
• Affected merchants and Shopify are told within 72 hours of the breach being confirmed, in plain language: what happened, what data was involved, when, and what has been done about it. If the picture is still incomplete at 72 hours, they are told that instead of being told nothing.
• What was learned is written into this page or the code, so the same hole cannot be reopened later by someone who has forgotten.

To report a vulnerability or a suspected breach, email hjuhyun35@gmail.com. Reports are read by the developer directly.

Service providers

The app runs on Cloudflare, which provides both the server that answers requests and the database behind it. Shopify is the source of all merchant and store data. No other third party receives data from this app: there is no analytics service, no error-reporting service, and no advertising or marketing tooling.

What the app does not do

• It does not add any code, script, or pixel to a storefront.
• It does not track shoppers or visitors.
• It does not sell, rent, or share data with anyone.
• It does not use merchant data to train machine learning models.
• It does not send email to merchants or their customers.

Changes to this policy

If the app ever changes what it reads or stores, this page will be updated before that change ships, and the date at the top will change with it.

Contact

Questions about this policy or about data handling: hjuhyun35@gmail.com