Privacy Policy

Version 1.2 · Effective 9 October 2026 · Operator: SoftArchium (Suraj Chavda), India · Contact: support@softarchium.com

This policy covers two things: this website (shiprescue.softarchium.com) and the ShipRescue app for Shopify. We keep both deliberately simple: we collect as little as the product needs, we sell nothing to anyone, and we run no advertising or cross-site tracking.

1. This website

• No cookies, no analytics trackers. The site sets no cookies and loads no third-party scripts, fonts, pixels or analytics.
• Waitlist. If you submit your email to the launch waitlist, we store that email address with a timestamp and a shortened hash of your IP address (the first 16 characters of a SHA-256 hash, kept to spot duplicate or abusive signups) in a file on our server, outside the public web folder. Each signup also sends a notification email to support@softarchium.com carrying the address and the time, sent by the website's server. We use the address for exactly one purpose: telling you when ShipRescue launches (and, at most, a small number of launch-related updates). We do not share, sell, or enrich it. Ask us at support@softarchium.com and we will delete it; the list itself is deleted once the launch mailing has gone out.
• Server logs. Our hosting provider (Hostinger) keeps standard web-server logs (IP address, user agent, pages requested) for security and operations, per their own retention rules.

2. The ShipRescue app (for Shopify merchants)

ShipRescue diagnoses why checkouts fail at the delivery step. To do that, when you install it on your store it reads, via Shopify's Admin API:

• Shipping configuration: delivery profiles, zones, rates and their weight/price conditions, carrier services, whether each profile is managed by your store or by another app, and whether a profile covers all items;
• Markets and their countries;
• Locations and their fulfillment settings;
• Products and variants: titles, prices, weights, publication status;
• Inventory levels per location;
• Delivery customizations: which of them are switched on, with their titles and the names of the functions and apps that provide them. These are rules, usually from other apps, that can change which delivery options appear at checkout. The app reads them only so it can tell you that another app may change what a shopper sees; it never changes them.

The app stores point-in-time snapshots of this configuration and the diagnoses computed from it, so it can show you what changed and when. ShipRescue never changes your shipping settings, products, inventory or existing orders. Every fix is applied by you, in your own Shopify admin.

There is exactly one thing the app writes, and only when you click it: a draft order. On the Scale plan you can rescue a failed checkout by creating a draft order carrying a shipping price you confirm, and then either copying its pay link to send yourself or asking Shopify to email it to that shopper. Both are actions you take; nothing is ever sent automatically. This is why the app holds the write_draft_orders permission, and it is the only write permission it holds.

The app also receives abandoned checkouts and orders from Shopify, on every plan, including Free. Shopify sends a notice each time a checkout is created or updated and each time an order is created, and the app reduces each one to the fields below before anything is stored. What depends on the plan is what the app does with them: diagnosing why a checkout failed at the delivery step, totalling the cart value that was blocked, and reading recent checkout history from Shopify's Admin API are paid-plan features, so on Free the app stores these reduced records but does not diagnose them. This is Protected Customer Data under Shopify's rules, and the app is built to hold as little of it as possible. Per shopper it stores only:

• a one-way keyed hash (HMAC) of the email address, used to match a later order back to the abandoned cart. The address itself is never stored, and the key is per-store, so the hash cannot be looked up or reversed;
• the destination country, province or state, and the first three characters of the postcode, which is what shipping-rate resolution actually depends on;
• the cart's line items as product variant ids, quantities and prices, plus the cart total and currency;
• any discount codes applied to the cart, with the amount each took off, and the checkout's token (the identifier in its recovery link, without the link itself);
• for an order, Shopify's order id, the time it was placed, the same email hash, the product variant ids, and the order total and currency;
• for a customer data request from Shopify, Shopify's numeric customer id, the email hash and counts of the records we hold. This is kept with no automatic expiry, until it is deleted by a redaction request for that shopper or when your store's data is deleted.

An abandoned-checkout record is deleted 90 days after the checkout was abandoned, and an order record 14 days after the order was placed. Briefly, while a notice is being processed, the reduced record waits in a job queue inside the same database; the raw notice itself is never stored or logged. The app never stores a shopper's name, phone number, street address, or the checkout recovery link. When you click Create the pay link on a rescue, the app fetches that shopper's email address live from Shopify, if it can read one, hands it straight to Shopify to address the draft order, and does not keep it. The pay link is shown to you and is not stored. Shopper data is never sold, never shared, and never used for anything except the diagnosis shown to the merchant who owns the store.

Storefront delivery checker (Growth and Scale plans, only if you add it to your store). When a shopper uses the checker on your storefront, their browser sends the cart's product variant ids and quantities, the country, province and postcode they entered, any percentage cart discount, the shopper's market country, and whether the check is on a product or cart page to ShipRescue through your store's app proxy, and the app answers from your stored configuration. Shopify's app proxy also adds the shopper's customer id to the request if they are logged in; the app receives it and does not store or log it. Nothing from that request is stored. The only thing written is a per-day count of checks for your store, shown to you as a usage number. The shopper's IP address is held in memory for rate limiting and is never written to the database or to logs. The checker sets no cookies and uses no browser storage.

Weekly digest address. If you choose an email address for the weekly digest (a Scale plan feature, set in Settings or when you subscribe), we store it against your store and use it only to send you that digest. You can clear it in Settings at any time, which stops the digest. The digest names your store, the count of open settings issues and the total blocked cart value, and carries no shopper data. It is sent through a mailbox we run on Hostinger, so Hostinger's mail servers handle it. The same mailbox carries a once-a-day internal alert to us if a store's sync has stalled, which lists the domains of the affected stores, each store's sync status and the last sync error text (with any email address removed, cut to 200 characters).

3. Data deletion

• When you uninstall, the app's access is revoked immediately. Shopify then sends its shop/redact webhook (48 hours after uninstall), and we delete everything we hold for your store (configuration snapshots, locations and markets, checkout and order records, diagnoses and audit runs, rescue records, widget settings, your digest address and your stored access tokens) in response, within the timelines Shopify mandates. If that notice never reaches us, the app deletes the same data automatically 30 days after you uninstall, after first checking with Shopify that you have not reinstalled. Two narrow exceptions follow. First, if you had a paid subscription, we keep a record of your store's domain, plan, Shopify's subscription id and paid-through date, so that reinstalling later in a period you already paid for still gives you that plan until it ends, rather than losing it because of the uninstall. That record holds nothing about your business or your shoppers, is never kept more than 31 days past your last payment, and is deleted automatically once that date passes. Second, we keep a log of the notices Shopify has sent us for privacy requests (customers/data_request, customers/redact and shop/redact): the store's domain, the notice type, Shopify's notice id and the times it was received and processed. It holds no content and is the record that a request was received and handled. It has no automatic expiry.
• We honour Shopify's customers/data_request and customers/redact webhooks. A data request is answered inside the app: the merchant sees the request under Settings, with the full list of what we hold for that shopper, ready to pass on. A redaction deletes every record we hold that matches that shopper's email hash, including any standing data request, and every order Shopify names in the request along with the checkouts those orders completed. So that data already on its way to us cannot be stored again, we keep the hash itself and the ids of what we deleted for 120 days, then delete those too. Deleting a store also destroys that store's hashing key, which permanently breaks the link between any remaining record and any real person.
• Other records expire on their own, whether or not you ever uninstall, in an automatic hourly sweep: abandoned-checkout records after 90 days, order records after 14 days, and the log of other Shopify notices (not the privacy notices above) after 14 days. Of your stored configuration snapshots, we keep the newest 30 (a count of snapshots, not days, so a store that rarely changes its settings can hold snapshots older than 30 days), the current one, any snapshot that a retained diagnosis or settings audit refers to, and the newest snapshot taken at or before 90 days ago (or, until one is that old, the oldest snapshot), so older checkouts can still be explained. A snapshot used to diagnose a checkout stays until that checkout expires, 90 days after it was abandoned. Only the newest settings audit and its findings are kept for your store. The clean-up runs hourly and removes a limited number of records per store each time, so deletions usually happen within hours, and a large backlog clears over the following runs. The raw copy of what Shopify returned for a snapshot is cleared after 30 days, leaving only the processed form.
• You can request deletion of anything, any time: support@softarchium.com.

4. Where data lives, and who else touches it

App data is stored in a managed PostgreSQL database operated by our app-hosting provider (Render, in its Oregon, United States region, where the web app and the background worker also run), which encrypts its database storage and backups at rest. On top of that, ShipRescue encrypts the most sensitive values itself with AES-256-GCM before they are written (your store's Shopify access tokens and the per-store key used for email hashing), so they are unreadable even to someone holding the database. This website, its waitlist file and the mailbox used for the digest and alert emails are provided by Hostinger. We use no data brokers, no advertising networks, and no analytics services. If a future subprocessor is added, this policy will be updated first.

In full, the companies that process data for us are: Render (app hosting, database and the background worker), Hostinger (website, waitlist file, and the mailbox for the digest and alert emails; its servers for us are in India, with backups in Singapore), Sentry (error reports, below) and Better Stack (operational logs and a heartbeat signal, below).

Error monitoring (Sentry). When the app hits an unexpected error, a report goes to Sentry, an error-monitoring service operated by Functional Software, Inc., stored in the United States. A report holds the error message and stack trace (which file and line failed), the app part that failed (web app or background worker, and for background work the job type and job number), the app version and the server's runtime details. It never holds shopper personal data: before a report leaves our server we remove request bodies, cookies, headers and query strings, and blank out anything shaped like an email address, an access token or a password. The app sends Sentry no usage analytics, no performance tracing and no session recordings, only error reports. This website sends Sentry nothing.

Operational logs (Better Stack). The app's operational log lines (for example "sync finished", "job failed", "request served") are forwarded by our app-hosting provider to Better Stack, a log-management service operated by Better Stack, Inc., stored in the United States, and kept for the short retention period of our logging plan (currently 3 days on the free plan we use). A line names the shop (its myshopify.com address), what happened, counts and durations, and for a web request its method, path and status. The same scrubbing applies before a line is written: no request bodies, query strings, email addresses, phone numbers, street addresses, names or checkout recovery links, and no shopper IP addresses. Better Stack also receives a once-per-sync "still working" signal that carries no data at all.

5. Changes

We will post any change to this policy on this page with a new version number and effective date. Material changes to how app data is handled will also be announced to installed merchants.

What changed in version 1.2 (9 October 2026). This version describes more fully what the app already did; it does not add any new collection. It now states: that the waitlist keeps a shortened IP hash and sends a notification email; that delivery customizations are read; that abandoned checkouts and orders are received and stored on every plan, including Free; what is stored for an order and how long checkout and order records are kept; how the storefront delivery checker handles shopper data; the weekly digest address and the mail route; the log of privacy notices kept after uninstall; the automatic deletion 30 days after uninstall; how configuration snapshots are pruned; and the full list of companies that process data for us, with the region of each: Render, Sentry and Better Stack in the United States, and Hostinger in India with backups in Singapore.

6. Contact

SoftArchium · support@softarchium.com. This policy is governed by the laws of India.