Privacy policy
What our apps receive, why, and what happens to it
This policy covers every app App Still Works publishes, including Still Works Standing Orders and Still Works Classes. It is written in plain English, and this is the whole policy. There is no longer version hiding behind it.
Who we are
App Still Works is a small app studio run by Jon Barney in Salt Lake City, Utah, United States. Its apps currently run on Shopify. For anything in this policy, write to jon@appstillworks.com.
In the language of privacy law, the merchant who installs an app is the "controller" of their customers' data, and App Still Works is a "processor" that acts on the merchant's instructions. Put simply: it is your data, and we handle it only to run the app for you. Where this policy says "we," it means App Still Works.
What the app receives from Shopify
When you install one of our apps, Shopify gives it access to the items below. Each app asks only for what it needs to do its job.
Still Works Standing Orders
| Data | Why the app needs it |
|---|---|
| Store details: shop name, myshopify domain, store owner email, currency, timezone | To run the app for the right store, send you emails, and bill in your currency and time zone. |
| Products and selling plans | To know which products can be ordered on a standing basis, and on what terms. |
| Subscription contracts | To schedule each standing order, bill it, and let the customer skip, pause, or change their day. |
| Orders created by those contracts | To build your production list for each day and to show customers their order history. |
| Customer name and email | To show you who is picking up on a given day, and to send the customer their order emails. |
| Delivery address, for local-delivery subscriptions only | To put the address on your delivery list. Pickup orders do not include an address. |
In short: the data is used to schedule and bill standing orders, to show you a list for each day of what to make and who is collecting it, and to send customers their order emails, such as a reminder that an order is coming, a skip confirmation, or a notice that a card failed.
Still Works Classes
| Data | Why the app needs it |
|---|---|
| Store details: shop name, myshopify domain, store owner email, currency, timezone | To run the app for the right store, send you the daily email, and show class times in your time zone. |
| Products | To know which product sells a seat in which class, and to show its dates on the product page. |
| Orders that book a seat | To put the student on the roster with the right date and number of seats, to release the seats if the order is cancelled, and to close the order when the student is checked in. |
| Customer name, email, and phone | To show you who is coming, to send the student their class emails, and so you can reach a late student on the day. |
| What the student typed at checkout | An order note or a checkout question, such as an allergy or a companion's name, shown on the roster next to their name. |
In short: the data is used to sell seats on a date, to show you who is coming, and to send students the things Shopify does not say: where the class is, what to bring, a reminder the day before, and a note if the class moves or a seat opens. Still Works Classes does not bill anyone. Seats are paid through your store's checkout like any other product, and refunds are made by you through the order.
What we do not collect
We never see or store card numbers. Shopify keeps the customer's payment method in its own vault. Still Works Standing Orders holds only a reference to it, enough to ask Shopify to charge the card and nothing more; Still Works Classes holds no reference at all, because it never charges anyone. We do not track browsing. We do not read customer data that has nothing to do with standing orders. We do not build a profile of anyone.
Where data lives
App data lives in a managed database, hosted in the United States and encrypted while it sits on disk. The emails the app sends, such as order reminders and the export sent when you uninstall, go out through an email delivery service. That service receives the recipient's address and the content of the message, only so it can deliver it. Data is not stored outside the United States.
How long we keep it
- While the app is installed. Data is kept as long as you have the app installed, because the app needs it to run.
- After uninstall. Shopify sends the app a shop/redact notice 48 hours after you uninstall. When it arrives, the store's data is deleted, including every subscription contract, booking, order, and customer record the app held.
- Customer deletion. When Shopify sends a customers/redact notice for one customer, that customer's data is deleted from the app. In Still Works Classes the seat count stays on the roster so your headcount is right, and the person is removed from it: no name, email, phone, or notes.
- Backups. Database backups roll off on a schedule and are never kept longer than 30 days.
Shopify privacy requests
Every App Still Works app honors the three privacy requests Shopify requires every app to handle:
- customers/data_request. When a customer asks a merchant for their data, we give the merchant what the app holds about that customer, so the merchant can pass it along.
- customers/redact. We delete that customer's data from the app.
- shop/redact. We delete all of the store's data from the app, 48 hours after uninstall.
No selling, no sharing, no advertising
We do not sell personal data. We do not share it with anyone except the service providers named above, and they handle it only on our behalf. We do not use it for advertising. We do not use it to train anything. We do not combine it across merchants. If a law enforcement request required us to disclose data, we would tell the merchant unless the law prevented us.
Cookies
Our apps run inside the Shopify admin. The only cookies or similar storage involved are the ones the Shopify admin needs to keep you signed in and to protect against forged requests from other sites. We do not set tracking or advertising cookies, and this website sets no cookies at all.
Your rights
If you are in the European Economic Area, the United Kingdom, or another place with a data protection law such as the GDPR, you have the right to see the personal data we hold about you, to correct it, to have it deleted, to limit or object to how it is used, and to get a copy in a portable format. If you live in California, the CCPA gives you the right to know what personal information is collected and how it is used, to have it deleted, to opt out of its sale (we do not sell it), and to be treated the same whether or not you use those rights.
To use any of these rights, email jon@appstillworks.com. If you are a customer of a store that uses one of our apps, the fastest path is to ask the store directly. The merchant is the controller of your data and can send the request through Shopify for you. You can also write to us, and we will reply within 30 days. We may ask for enough information to confirm you are who you say you are.
Children
Our apps and this website are not meant for anyone under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us data through one of our apps, email us and it will be deleted.
Changes to this policy
If this policy changes in a way that matters, the effective date at the top changes, and merchants with the app installed are told by email before the change takes effect. Small wording changes are made without notice. The current version always lives at appstillworks.com/privacy.html.
Contact
App Still Works, Salt Lake City, Utah, United States. jon@appstillworks.com.