Sortby never sees your customers’ data

Sortby requests exactly two Shopify access scopes: read_products and write_products. It does not request access to customers, orders, draft orders, checkouts, discounts, or any other part of your store. Shopify shows you this list on the install screen and enforces it at the API level.

Your shop domain, installation state and access tokens

The myshopify.com domain of the store, whether the app is currently installed and the dates you installed and uninstalled it, plus the OAuth tokens that let Sortby call the Shopify API on its behalf. Tokens are encrypted at rest and destroyed the moment you uninstall.

A copy of your product catalogue

Titles, handles, descriptions, vendor, product type, tags, status, price range, inventory totals, featured image URL and the created, updated and published dates. Sortby needs these locally to score products without hitting the API on every sort.

Product metafields

Namespace, key, type and value for the metafields on your products, so they can be used as sort criteria. Whatever you have chosen to store in a product metafield is copied as-is.

Collections and your rules

Collection titles, handles, product counts, and the boost and sort rules you configured, plus the computed sort scores and a log of sort and import runs.

• ✕Customer names, emails, phone numbers or addresses
• ✕Orders, carts or checkout data
• ✕Payment or card details
• ✕Storefront visitor tracking of any kind

Because none of this data is ever requested, there is nothing to compile when a customer files a data request, and nothing to erase when they ask to be forgotten.

When you uninstall Sortby, the app receives Shopify’s app/uninstalled webhook and immediately destroys the access and refresh tokens it holds for your store. From that moment it cannot reach your store, and every scheduled job skips it.

Your catalogue copy, metafields, collections and rules stay for a short window, so that reinstalling resumes where you left off rather than making you import everything and rebuild every rule.

That window closes on Shopify’s shop/redact request, about 48 hours after uninstall, on which all of it is deleted. If that request never arrives, a daily job does the same for any store uninstalled more than 30 days earlier — so your data is gone within 30 days at the outside, and usually within two.

What survives is one row with four things in it: your myshopify.com domain, the fact that the app is no longer installed, and the dates you installed and uninstalled. No credentials, no catalogue, nothing about your products. It exists so we can recognise a store that comes back and so the free trial cannot be reset by uninstalling and reinstalling — and we delete it if you ask us to.

All three of Shopify’s privacy webhooks are registered and handled, with their authenticity verified by HMAC signature:

• customers/data_request — acknowledged; Sortby holds no customer data to compile.
• customers/redact — acknowledged; there is no customer data to erase.
• shop/redact — deletes the catalogue copy, metafields, collections and rules, and reduces the shop record to the four fields described above.

Sortby sends your data to no one. The app has no analytics, no error tracking service, no email provider, no AI service and no payment processor inside it. Its only outbound calls are to Shopify’s own Admin and Partner APIs, to read your catalogue, write the new collection order, and check which plan the store is subscribed to.

Payments are handled entirely by Shopify through its managed pricing. Sortby never sees a card number.

OAuth access tokens are encrypted at rest in the database. Sortby uses short-lived tokens that are refreshed automatically, so a token is not valid indefinitely. Sensitive parameters are filtered out of application logs.

Sortby is built and operated by inkOfPixel Srl, Piazza Castello 26, 20121 Milano, Italy. For any question about data handling, or to exercise your rights under the GDPR, write to [email protected].

This page is a plain-language summary of how the app behaves. The privacy policy is the binding document.