Privacy Policy

The merchant is the store that installs the app. The player is a shopper who plays a game in the merchant's store. For player data the merchant decides why it is collected and we process it on the merchant's behalf.

• From merchants: the store address (.myshopify.com), the access token Shopify gives us when the app is installed (stored encrypted), the admin account email and a hashed password, and the game, prize and theme settings the merchant enters.
• From players: the email address they enter to play, a one-time code sent to that email (stored only as a hash and valid for 5 minutes), their play attempts, the prize they won, and the discount code created for it.
• Technical: a session cookie that keeps a player signed in after they verify their email (about one hour), and a session cookie for merchant admins. We do not use advertising or tracking cookies. Cookie-free, aggregated page-view statistics are collected through Vercel Web Analytics.

We do not receive your store's customers, orders, products or payment details from Shopify. The app asks Shopify only for permission to create discount codes (write_discounts). We never see payment card details.

• To verify a player's email, run the game fairly and limit plays per day.
• To create the winner's discount code in the merchant's Shopify store and show it to the winner.
• To show the merchant reports of plays and prizes, and to keep the service secure.

We do not sell personal data and we do not use it for advertising.

Only service providers that run the app, each under its own privacy terms:

• Shopify (the store platform where discount codes are created)
• Vercel (hosting and aggregated analytics)
• Neon (database)
• Resend (sending verification emails)

Merchant and player data is kept while the merchant uses the app, so reports stay available. When a store uninstalls the app we delete the stored Shopify access token right away, and we delete the store's connection data again when Shopify sends its data-erasure request. Player data for a store is deleted on the merchant's request, or when a player asks us (see below).

Players and merchants can ask us to access, correct or delete their data, or to stop processing it. Players can also ask the store they played in. Write to us at the address below and tell us the email used to play and the store's name; we may need to verify that the email is yours.

Connections use HTTPS. Shopify access tokens are encrypted at rest, one-time codes are stored hashed, and admin access is restricted to authenticated merchants. No system is perfectly secure, but we work to protect your data and to fix issues quickly.

We may update this policy and will change the date above when we do.

Contact: support@globalworkshub.com