Colorway privacy policy

What this policy covers

Colorway is a Shopify app for merchants. It gathers separate products, such as one product per colour, into groups, and shows each group's colour swatches on its products' pages and under their product cards. This policy describes what data the app reads from your store, where your groups are kept, what the app stores itself, who else handles it, and how to have it deleted.

The app is used by merchants only. It never contacts your customers, sets no cookies on your storefront, and has no analytics or tracking of any kind.

What the app reads from your store

Through Shopify's Admin API, with the product access you grant when you install it, the app reads your products: their titles, handles, tags, status, whether they're on the Online Store, and their featured images. It reads them to build and check your groups, to suggest groups from titles and tags, and to import and export them.

The app has no access to your orders or your customers, and never reads either.

Where your groups are kept

Your groups are saved in your own Shopify store, not on Colorway's servers:

• each group is a metaobject owned by the app, holding the group's name, its products in order, each product's swatch (its label, and its colours or image) and whether the group is active;
• each product in a group has a metafield owned by the app that points at its group.

The app's theme extension reads them from your store to show the swatches, so your shoppers' browsers never contact Colorway.

What the app stores itself

The app's own database holds only your store's myshopify.com domain and the access token Shopify issues so the app can act on your store, with the token's refresh token, its expiry and the access scopes you granted. Your plan is read from Shopify when it's needed, not stored.

The hosting provider's request logs record your store's myshopify.com domain against the app's requests and webhooks, for diagnosing problems. They are kept for a few days and then deleted by the provider.

What the app never stores

The app never reads or stores personal data: no customer names, email addresses, phone numbers or addresses, and no order data. It keeps no record of your staff either.

The app does not sell or share data, and does not use it for advertising, marketing, analytics or profiling.

Why the app uses this data

Solely to manage your groups and show their swatches on your storefront, to suggest, import and export groups, and to apply the plan you're on. There is no other use.

Who else handles this data

Two providers process data on the app's behalf:

• Shopify: the platform your store runs on. Your products and your groups live there, and Shopify handles the app's billing.
• Cloudflare: hosts the app and its database. Data is encrypted in transit (HTTPS) and at rest.

No other third party receives data from the app.

How long data is kept

When you uninstall the app, Shopify notifies it and the app immediately deletes everything its database holds for your store: the domain and the access token. 48 hours after uninstall Shopify also sends the app a shop/redact request, and the app runs the same deletion again so nothing is left behind. The request logs age out on their own within a few days.

Your groups are in your store, so Shopify handles them: when you uninstall, it removes the app's group definitions straight away and deletes the groups and their product links on its own schedule. It may keep them for a while, so reinstalling soon can bring them back. To keep a copy, export your groups from the app's Import and export page before you uninstall.

Uninstalling leaves your products otherwise as they were. The swatches leave your theme with the app, because Shopify removes an app's theme blocks when it's uninstalled, and the app never edits your theme's code.

How data is protected

All traffic between your browser, Shopify and the app uses HTTPS, and the database is encrypted at rest by the hosting provider. The access token is only ever used on the server and is never sent to the browser. Access to the production database is limited to the app's operator.

Your rights and how to request deletion

You can ask at any time for a copy of the data the app holds for your store, or for it to be deleted. Email info@andrewtechful.com from your store's owner or staff address so the request can be verified; we aim to answer within one business day and to complete a deletion within 30 days. Uninstalling the app also triggers the deletion described above, and your groups can be exported at any time.

If one of your customers asks you for their data or for its erasure, Shopify forwards the request to the app (the customers/data_request and customers/redact webhooks). Because the app holds no customer data, there is nothing to return or delete on its side.

Depending on where you and your customers are, you may have legal rights, for example under the GDPR or the CCPA, to access, correct, delete or restrict the use of personal data. Contact us to exercise them.

Changes to this policy

This policy took effect on October 3, 2026. If it changes, the updated version is published at this address with a new effective date.

Contact

Questions about this policy, or a deletion request: info@andrewtechful.com