PRIVACY NOTICE

Data boundaries for prospective studies.

Last updated September 9, 2026. This notice describes the current development implementation.

Shopify data the app uses

ReturnTrace stores Shopify shop and server-side session data, granted scopes, selected product and variant references, complete catalog snapshots, approved change boundaries, study definitions, jobs, coverage states, aggregate evidence, and limited webhook delivery metadata.

For an active study, the app reads bounded order, fulfillment, line-item, and return facts needed to place fulfilled units and returns into the approved before-and-after windows. Raw normalized cohort evidence is encrypted at rest. The app does not query names, email addresses, postal addresses, payment details, or message content.

Purpose and limits

The data supports prospective observational studies around a merchant-approved catalog change. Findings report correlation and coverage. They do not identify a customer, attribute causation, reconstruct history before the baseline, or prove which catalog change produced an outcome.

Retention and export

Encrypted raw cohort evidence is purged after 120 days. Aggregate evidence and archived or otherwise inactive studies are removed after 365 days. A study paused for missing access with no evidence or archive timestamp uses its creation date for that limit; active monitoring and other paused states do not use this fallback. Cleanup is bounded and requires the deployed worker to continue running, so an expired record can remain until a later cleanup pass.

The authenticated JSON export includes at most 100 studies and 512 KiB, reports truncation, and replaces Shopify resource identities with keyed references. It excludes customer data, raw cohort records, and raw order, fulfillment, return, product, variant, and line-item identifiers.

When Shopify sends a customer data request, ReturnTrace creates a separate encrypted disclosure for the merchant. It includes only stored cohort facts linked to the order IDs Shopify supplied; ReturnTrace cannot match a customer ID alone because it does not store a customer-to-order directory. The merchant can download the disclosure from an authenticated app page for 35 days. It never adds customer data to the general evidence export.

Access removal and erasure

Loss of required product, order, or return access pauses new collection, clears unfinished collection checkpoints, and preserves existing evidence for review and export. The authenticated current merchant installation can still export retained evidence and download completed customer disclosures while collection access is paused. A confirmed uninstall erases active or access-paused app records and server-side sessions. If an uninstall callback cannot be verified against the current installation, ReturnTrace preserves retained data until authoritative lifecycle evidence is available. A remotely verified current installation is preserved. An authenticated Shopify shop-redaction request can complete erasure of active or access-paused records when no offline session remains.

Customer-redaction handling removes any study whose normalized evidence includes an order Shopify identifies for redaction and removes matching pending disclosures; ReturnTrace removes the whole study because subtracting a customer after aggregation could create a misleading result. An independent keyed erasure record prevents an older database backup from restoring erased app data. Keyed lifecycle receipts can remain for up to 35 days to reject delayed callbacks without retaining a plain shop domain, customer identity, order identity, or raw delivery identity. Exported copies remain under the merchant’s control.

Contact and release status

New Tech is operated by Justin Walker in New York, United States.

Support email is handled separately from the app database by the sending and receiving email providers. Uninstalling the app or deleting app records does not automatically delete those email copies.

Email justinwalker4233@outlook.com for app data questions or requests for access, correction, deletion, or restriction of app-held data.