Cart Filler – Privacy Policy

Last updated: 8 September 2026

This policy explains what sK Cart Filler (“the app”) does with data. It is short because the app collects very little.

What the app stores

When you install the app, we store two things:

• Your store’s domain (for example your-store.myshopify.com) and the access token Shopify issues so the app can talk to your store.
• Your plan status – whether your store is on the free or Pro plan, and whether your store has already used its free trial.

That is the complete list.

What the app does not access

sK Cart Filler requests no access scopes. It cannot read or write:

• Products, collections or inventory
• Orders, carts or checkouts
• Customers or any customer personal data
• Discounts, price rules or payouts
• Files, themes or any other store resource

You can confirm this on the installation screen: Shopify lists the permissions an app requests before you install it, and this app requests none.

What happens on your storefront

The bar and its suggestions are rendered by your theme as ordinary HTML, and the settings live in your theme’s own settings. Visitors to your store never contact our servers.

Two pieces of data are read in the shopper’s browser, both from your own store’s domain, never from ours:

• The cart, from your store’s /cart.js endpoint, so the app knows how much is left to your threshold and which products are already in the cart.
• Your public product list, from your store’s /collections/…/products.json endpoint, so the app can pick products that close the gap. This is the same public catalogue data your theme already uses.

Neither request is sent to us, logged by us, or associated with a shopper.

The app does not use cookies, tracking pixels, analytics, fingerprinting, or any third-party script on your storefront. It does not record who saw a suggestion, what was in their cart, or whether they clicked Add.

Shopify’s mandatory privacy webhooks

Shopify requires every public app to respond to three privacy requests. Here is how this app handles them:

Request	Our response
customers/data_request – a shopper asks for their data	Nothing to provide. We hold no customer data.
customers/redact – a shopper asks to be deleted	Nothing to delete. We hold no customer data.
shop/redact – a store is deleted, 48 hours after uninstall	We delete your store’s domain, access token and plan record.

Where data is stored

Store domain and plan status are held in a Postgres database hosted in the European Union (Frankfurt region). Data is transmitted over TLS.

How long data is kept

Your access token is deleted immediately when you uninstall the app. Your store record is deleted when Shopify sends the shop/redact request, which happens 48 hours after uninstall.

Sub-processors

Provider	Purpose	Location
Shopify	App platform, billing	Global
Neon	Postgres database	EU (Frankfurt)
Vercel	Application hosting	EU

No other party receives any data.

Changes to this policy

If this policy changes in a way that affects what we store, we will update the date at the top and notify merchants through the app.