Privacy Policy — Snag (Smart Wishlist & Likes)

Last updated: October 11, 2026

What Snag Does

Snag is a Shopify app that lets shoppers "like" (heart) products on your online store. Merchants get analytics on product interest. Shoppers can optionally save their email to persist their liked items across visits.

Data We Collect

From Shoppers

• Anonymous browser identifier (UUID): Generated automatically and stored in the browser's localStorage. This is not a personal identifier — it's a random string that tracks which products have been liked in that browser session.
• Email address (optional): Only collected if the shopper voluntarily enters it in the liked-items drawer. Used solely to associate liked products with the shopper across visits and to enable merchant sync features.
• Product like/unlike actions: Which products were liked or unliked, timestamps.

From Merchants

• Shop domain: Your Shopify store URL, used to identify your store in our system.
• Access tokens: OAuth tokens provided by Shopify to access your store's API. Stored encrypted at rest.
• Plan selection: Whether you're on the Free or Pro plan.

How We Use Data

• Shopper likes: Displayed to the individual shopper in their liked-items drawer. Aggregated anonymously for the merchant's analytics dashboard.
• Email addresses: Used only to associate likes with a shopper identity. Available to the merchant in the Pro plan's shoppers table. Can be synced to Shopify Customers at the merchant's request. Never sold, shared with third parties, or used for marketing by Snag.
• Analytics: Aggregated product interest data (total likes, trends, top products) shown to the merchant. No individual shopper behavior is exposed in the Free plan.

Data Storage

All data is stored on Cloudflare D1 (SQLite-based database), encrypted at rest and in transit via HTTPS. Cloudflare manages infrastructure security, encryption, and backups.

• Production database: like-app-shops — all live merchant and shopper data
• Development database: like-app-shops-dev — test data only, fully separated from production

Data Retention

• Active stores: Data is retained as long as the app is installed.
• Uninstalled stores: All shop data (products, likes, shopper emails, analytics) is permanently deleted within 48 hours of uninstall via the shop/redact compliance webhook.
• Customer data requests: Merchants can request all data associated with a specific customer via Shopify's customer data request mechanism. We respond within 30 days.
• Customer redaction: When a customer requests data deletion through a merchant, all their like data and email are permanently removed.

Data Sharing

We do not share, sell, or rent any shopper or merchant data with third parties.

Data is only shared:

• With Shopify when a merchant uses the "Sync to Customers" feature (Pro plan) — this creates or updates Shopify Customer records with like-related tags.
• With Cloudflare as our infrastructure provider for data processing and storage.

Security

• All API communication uses HTTPS
• OAuth tokens are encrypted at rest (Cloudflare managed)
• Admin API endpoints are protected by Shopify session token verification
• Compliance webhooks use HMAC signature verification (returns 401 on invalid signatures)
• 2FA enabled on all infrastructure accounts (Cloudflare, Shopify)
• Access logging on all admin-facing endpoints for audit compliance
• Test and production data are fully separated (separate D1 databases)

Compliance

Snag meets Shopify's Level 2 Protected Customer Data requirements:

• Minimum data processing (only email collected, no name/phone/address)
• Data used only for stated purposes (wishlist and sync)
• Data deletion within 48 hours of uninstall
• Encrypted at rest and in transit
• Separate test/production environments
• Data loss prevention policy
• Incident response policy
• Staff access limited (solo developer)
• Strong passwords with 2FA

Merchant Responsibilities

By installing Snag, merchants acknowledge:

• Shopper email collection is voluntary (shoppers opt in by entering their email)
• Merchants are responsible for their own privacy policies regarding shopper data
• The "Sync to Customers" feature adds tags to Shopify Customer records — merchants should ensure this aligns with their own data policies

Your Rights

Shoppers

• You can unlike products at any time to remove them from your liked items
• Your email is only collected if you voluntarily enter it
• You can request data deletion by contacting the store's merchant

Merchants

• You can export all shopper data via CSV (Pro plan)
• You can request complete data deletion by uninstalling the app
• All data is automatically deleted within 48 hours of uninstall

Contact

For privacy questions or data requests, contact: support.nativeuser@gmail.com

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted at the policy URL. Continued use of the app after changes constitutes acceptance of the updated policy.