Privacy policy
Last updated 8 October 2026
Rallybox (“the app”) is a Shopify app that lets a merchant offer product bundles and measure what those bundles do to their sales. This page describes every category of data the app receives, what it keeps, where that is stored and how to have it erased.
The app is installed by a merchant onto their own Shopify store. It has no sign-up of its own, no accounts and no users other than the staff of the store that installed it.
What the app stores
Everything the app writes is keyed to a store, never to a person. Order rows are the only records derived from a shopper’s activity, and they carry no identifier for that shopper.
| What | Why it is kept |
|---|---|
| The store’s domain and an access token issued by Shopify | To call the Shopify Admin API on the store’s behalf while the app is installed |
| Bundle and offer configuration written by the merchant: titles, prices, discounts, product and collection references, display settings | To render and price the bundles the merchant set up |
| For each order that went through a set or an offer: Shopify’s order id and order number, the subtotal in the store’s currency (goods after discounts, without shipping or tax), the currency, the order’s timestamp, which sets, offers and A/B pattern it went through, and the products picked into its sets (product id, product title and quantity) | To show the merchant the orders, revenue and average order value that came through each set and offer. The order number is what the merchant recognises; the order id stops a repeated webhook delivery from being counted twice. The picked products give the “most picked” list |
| For each order in an A/B test: a group letter (A, B or unknown), Shopify’s order id, the subtotal, the currency, the order’s timestamp, and which experiment it belongs to | To compare orders that saw a bundle against orders that did not. The order id is kept so a repeated webhook delivery is not counted twice |
| Page performance samples from the merchant’s own admin screens: a metric name, a number and the path it was measured on | To show the merchant how fast the app’s own screens are |
For each staff member who opens the app: Shopify’s staff user id and the admin language they use (for example ja) | To show the app in that person’s language on every screen |
| Records of the app’s own errors: the store’s domain, what the app was doing (for example “orders/create webhook”), the error message, how many times it happened and when | So that a failure is noticed and fixed. They are deleted after 30 days |
What the app does not store
- Customer names, email addresses, phone numbers or addresses
- Customer ids or any other per-person identifier
- IP addresses or browser user-agent strings
- Order lines outside the app’s sets, SKUs, or line prices — for the lines of a set, only the product id, title and quantity listed above
- Payment details of any kind
The orders/create webhook that Shopify delivers does contain customer fields. The app discards them at the point of receipt: only the columns in the table above are written.
Cookies
These cookies are set only when an A/B test is running. A/B testing is not currently offered, so they are not set.
When a merchant runs an A/B test, the storefront may set up to two first-party cookies. bundle_lift_group holds a group letter and an experiment name, for example A|holdout-v1; bundle_lift_pattern holds a pattern letter and the split it was drawn for, for example B|50. Neither contains a visitor id, so neither can be used to recognise a person, link two visits or track anyone across sites. The letters come from a random draw and are not derived from anything about the visitor. They last 90 days.
Both are analytics cookies: they exist only so the merchant can compare two groups. They are set only when the shopper has allowed analytics through the store’s cookie consent (Shopify’s Customer Privacy API). A shopper who has not is left out of the test: nothing is stored in their browser, their orders are counted in neither group, and they see the store as usual. If consent is later withdrawn, the cookies are removed. No advertising cookies are set.
Shopify’s mandatory privacy webhooks
Shopify requires every app to answer three requests. Here is exactly what each one does in this app.
| Request | What the app does |
|---|---|
customers/data_request — a shopper has asked the merchant what data is held about them | The app acknowledges the request and returns nothing, because it holds nothing keyed to a customer. There is no record to look up |
customers/redact — erase what is held about one shopper | The app acknowledges the request. There is nothing to erase: no row carries a customer id or any other per-person identifier, so a single shopper cannot be singled out in the data even in order to delete them |
shop/redact — sent 48 hours after the app is uninstalled: erase everything held for the store | The app deletes every row it holds for that store across all of its tables: the session, bundles, discount rules, product memberships, order statistics, attributed orders, performance samples, experiment settings, staff language settings, error records and the store record itself |
Uninstalling the app also triggers app/uninstalled, at which point the app immediately deletes the stored access token, the per-product data it had mirrored and the staff language settings. The remaining rows are removed by shop/redact as described above.
Where data is stored
- Database — a PostgreSQL database hosted by Supabase in the AWS
us-east-1region (United States). Access is restricted to the application. - Application — the app runs on Vercel, in the
iad1region (United States). Vercel handles the incoming request and the app’s own static files.
We use your store’s contact email address to send service notices about your plan, such as when the free allowance is nearly used. These emails are sent through Resend (resend.com).
Supabase, Vercel and, for those emails, Resend are subprocessors for the purpose of running this app. Data is not sold, is not shared with advertisers, and is not used to train anything. No other third party receives it.
How to have data deleted
There are two ways, and both end at the same place.
- Uninstall the app from the store’s Apps page. The access token and mirrored product data go immediately; Shopify then sends
shop/redactafter 48 hours and everything else for that store is deleted. - Ask directly. Email support@rallybox.app from an address on the store’s account, naming the store domain. Data is deleted within 30 days of the request, and usually far sooner.
Because nothing is keyed to an individual shopper, a shopper’s own access or erasure request is answered by the store that sold to them; the app holds no record that could be matched to them. A merchant can raise such a request on a shopper’s behalf through Shopify, which reaches the app as customers/data_request or customers/redact above.
How long data is kept
Configuration and order statistics are kept for as long as the app is installed, because they are what the merchant’s own screens are showing. After uninstall they are deleted as described above. Records of the app’s own errors are deleted after 30 days, or with the rest of the store’s data if that comes first. Nothing else is archived or retained beyond that, with one exception:
If your store used the full free allowance, we keep one record after deleting your store’s data: an irreversible fingerprint of your store, with no order, customer or product details. It is used only so that reinstalling the app does not reset the free allowance.
Changes to this policy
If what the app stores changes, this page changes with it and the date at the top is updated. Material changes are also communicated to installed merchants.
Contact
Questions about this policy, or about data the app holds: support@rallybox.app
The terms that govern the app, including its data processing terms, are at rallybox.app/terms.