Privacy Policy

Cart Unlock — Effective September 8, 2026

Cart Unlock ("the App") is a Shopify application that lets merchants restrict specific product collections behind a minimum cart order value. This policy explains what data the App collects, how it's used, and how it's protected.

What we collect

• Shop information: your store's domain and basic shop details provided by Shopify during installation (via standard OAuth), used solely to operate the App for your store.
• App configuration: the restriction rules you create (which collections are restricted, minimum order values, quantity limits, and customer-facing message text) and your selected plan. This is stored directly in your store's own Shopify metafields — Cart Unlock does not maintain a separate database of your configuration.
• Session data: authentication tokens required to securely communicate with the Shopify Admin API on your behalf.

What we do NOT collect

Cart Unlock does not access, store, or process any of your customers' personal information (names, emails, addresses, payment details, order history, etc.). All storefront enforcement (blocking or removing restricted products from a customer's cart) runs entirely in the customer's own browser and communicates directly with Shopify's cart APIs — it never routes customer data through Cart Unlock's servers.

Billing information

Subscription charges are processed entirely by Shopify Billing. Cart Unlock never receives or stores your payment card details.

Data retention & deletion

When you uninstall Cart Unlock, Shopify notifies us automatically via mandatory webhooks. Since all configuration data lives in your store's own Shopify metafields — not in a separate database we control — it is removed along with your store's data per Shopify's own data retention policies. We do not retain a separate copy.

Third parties

We do not sell, rent, or share your data with third parties. The App is hosted on Railway (a cloud hosting provider) and relies on Shopify's own infrastructure for storefront and Admin API operations — no other third-party service processes your data.

Security

We use Shopify's recommended authentication practices (OAuth 2.0, session tokens, expiring offline access tokens) and encrypted connections (HTTPS) for all communication.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected with an updated effective date on this page.

Contact us

For questions about this privacy policy or your data, contact support@gybcommerce.com.