Mix & Match Bundles

What we store

One thing, on our server: the Shopify OAuth session for your shop. That is the shop's domain, the access token Shopify issued to the app, and the scopes it was granted. It exists so the app can answer when your admin loads it, and so Shopify can verify that requests genuinely come from the app you installed.

That is the entire contents of our database. There is no user table, no customer table, no order table, and no analytics store.

What we never receive

Mix & Match Bundles does not receive:

• your customers' names, email addresses, phone numbers or shipping addresses;
• orders, draft orders, or order history;
• customer accounts or customer profiles;
• payment details of any kind, at any point;
• which products an individual shopper looked at, or what any individual shopper bought.

This is enforced by Shopify rather than promised by us. Order, Customer and DraftOrder are protected resources that require a separate written approval from Shopify before an app may touch them. We have not applied for that approval, so those requests fail for this app by design. You can see the app's full permission list on Shopify's install screen before you install, and at any time afterwards in your admin.

Where your bundle rules live

Your bundle configuration — which products may go in a box, the smallest and largest box you sell, and what each item costs at each size — is stored as metafields on your own Shopify store, not in our database. Uninstalling the app leaves that configuration on your store, and removing it removes ours too, because there is no second copy.

The app also creates and publishes the bundle's product for you, and updates its list price when your rules change. Those are ordinary products in your catalogue and they remain yours.

What happens when a shopper builds a box

What a shopper picked travels as a property on the cart line inside your own storefront. Three small programs then run on Shopify's own infrastructure, not on our server: one prices the box, one expands it into its individual products, and one re-checks it at checkout against your rules so a tampered box cannot buy a discount you never offered.

Those programs read the products in the cart and your bundle rules. They receive no shopper identity, and Mad Max Labs receives nothing from them at all. Because they run on Shopify's infrastructure, your storefront keeps selling normally even if our server is unreachable.

Data requests and deletion

Shopify requires every App Store app to answer three privacy requests, regardless of whether it collects personal data. This app answers all three:

• a request for a customer's data returns nothing, because we hold none;
• a request to delete a customer's data has nothing to delete, for the same reason;
• a request to delete a shop's data removes that shop's stored OAuth session.

Uninstalling the app from your store deletes the session we hold for it. Your bundle configuration and bundle products stay in your own store, where they always were, and you can remove them yourself.

Hosting

The app's admin screens and its Shopify webhook endpoints run on Fly.io, in a single region in the United States, on an encrypted volume. Shopify itself processes everything on the storefront and checkout side.

There are no other subprocessors. The app carries no analytics service, no error-tracking service, no advertising or marketing tags, no session recording, and no third-party scripts on your storefront.

What the app does not do

Mix & Match Bundles does not:

• sell or share any information;
• use advertising, remarketing or an advertising identifier;
• load a behavioural analytics or tracking script onto your storefront;
• track individual shoppers across pages, sessions or stores;
• read or write anything outside the scopes shown on the install screen.

Changes to this policy

We will update this policy if the app's permissions, hosting or features change, and the effective date above will change with it. If the app ever needs a permission that reaches customer information, that will be a change to the install screen you must approve, not a quiet edit here.

Contact

For privacy questions or requests, contact:

Mad Max Labs, Attn: Syed Zaid. Email: madmaxlabsllc@gmail.com. Website: madmaxlabs.com.