Privacy Policy

Last updated: September 2, 2026

Restock Forecast is a Shopify app that tells merchants when each of their products will run out of stock and how many units to reorder. This policy explains exactly what the app reads, what it stores, and what it does not touch.

What the app reads

When a merchant opens the app, it queries the Shopify Admin API for the data needed to calculate a forecast:

• Products and product variants: title, SKU, image, and status
• Inventory levels: the quantity on hand for each tracked variant, and, for stores with more than one location, how that quantity is split between them along with each location’s name
• Order line items: the product variant and the quantity ordered. The app reads recent orders on every visit, and once a day reads further back into the order history until it has about thirteen months.

Orders are read only to count how many units of each product were sold. The app does not read, request, or display customer names, email addresses, phone numbers, billing addresses, shipping addresses, or payment information.

Why Shopify tells you this app can see more than that

In your admin, under Settings › Apps, Shopify lists what this app is able to access. It says customer device and activity data: location, IP address, browser and operating system. That is worth explaining rather than leaving to look like a contradiction.

A Shopify order record carries those details, so any app permitted to read orders is permitted to read them too. Shopify describes the permission, not the behaviour, and it says the same thing about every app with that permission whether or not the app ever looks.

This app asks each order for two things: which product variant was bought, and how many. You can confirm the boundary yourself in the same admin screen — the fields Shopify treats as sensitive enough to be requested individually are name, email, phone and address, and this app requested none of them. Its approval on August 6, 2026 covers store management only.

There is no setting that would remove the line from that screen short of giving up access to orders, which is the sales history the forecast is made of.

What the app stores

The Shopify session for each installed store: the store domain, the API access token, and the granted permission scopes. This is what lets the app talk to Shopify on the merchant’s behalf.

A record of units sold, per product variant, per day. Shopify only exposes a limited window of order history through its API, so the only way the app can compare a season against the same season a year ago is to write each finished day down as it passes. Each row is a variant identifier, a date, and a number of units. That table contains no customer identifiers of any kind, and no order numbers, prices, or totals.

Alongside it: the days a variant had nothing on the shelf, so the sales rate can be divided by the days a product could actually be bought, including any the merchant confirms or rules out when asked whether a past gap in sales was a sell-out; any reorder rules the merchant sets themselves; a short-lived cache of the sales figures for the current window; and a count of visits used to decide when the app may ask for a review.

A ledger of price changes: for each product variant, the price before a change and the price after it, with the time it was seen. Shopify keeps no history of what a product used to cost, so this is the only record there is — it is what lets the app tell a merchant that a price fell ninety per cent overnight and offer to put it back. It starts when the app is installed, holds product prices and never customer data, and is deleted with everything else on uninstall. The thresholds that decide which changes are worth flagging are the merchant’s own settings and are stored with them.

If the merchant uses the ordering and counting features, the app also stores what those features are: the suppliers they enter, including a business name and the email address a purchase order is sent to; the purchase orders themselves, with the product, quantity and cost on each line; the stock counts, with what Shopify believed and what was found on the shelf; and a record of every stock change the app has written into Shopify, so the merchant can see in one place what this app did to their inventory. When the merchant asks for a purchase order to show in Shopify as incoming stock, the app creates a transfer for it in their store and keeps the transfer’s id on the order; the transfer itself lives in Shopify. When the merchant brings in a Stocky purchase order export, the file is read in their browser and only the orders, suppliers and costs in it are stored, as purchase orders like any other; the file itself is not kept. All of this is entered by the merchant or produced by their own actions in the app. None of it is customer data.

Apart from those records, inventory levels are not written to disk. Stock on hand is requested from Shopify when a page loads, used to compute the forecast in memory, and discarded when the response is sent.

Retention and deletion

When a merchant uninstalls the app, Shopify sends an app/uninstalled webhook and the app deletes that store’s session immediately. The access token stops working at that moment, and the app can no longer read anything from the store.

The stored sales record is erased about forty-eight hours later, when Shopify sends the shop/redact webhook. Everything keyed to that store goes with it. The delay is Shopify’s design and it is useful: an uninstall is often a mistake or part of a reinstall, and a merchant who comes back the next morning would otherwise have lost a year of history that cannot be rebuilt.

A merchant can also request immediate deletion at any time by emailing hjuhyun35@gmail.com.

If a shopper asks what the app holds about them, or asks for it to be erased, the answer is that it holds nothing. The sales record counts units against a product and a date, with nothing recording who bought them, so there is no row belonging to any individual.

Security

• All traffic runs over HTTPS.
• The database is a managed PostgreSQL instance with encryption at rest.
• Access tokens are stored server-side and are never exposed to the browser.

Service providers

The app runs on Fly.io, which provides hosting and the managed database. Shopify is the source of all merchant and store data. No other third parties receive data from this app.

What the app does not do

• It does not add any code, script, or pixel to a storefront.
• It does not track shoppers or visitors.
• It does not sell, rent, or share data with anyone.
• It does not use merchant data to train machine learning models.
• It does not send email to your customers, ever.

The weekly email

If it is switched on, this app sends the shop owner one email a week — and only in a week when something is out of stock or needs ordering before a delivery could arrive. In a week with nothing to report it sends nothing at all.

It goes to the shop owner’s email address as Shopify holds it, read at the moment of sending and not stored. No customer is ever emailed, and no customer address is ever read.

Every message carries a link that switches it off without logging in, and the same switch is in the app under the planning assumptions. Switching it off is permanent — nothing asks again.

Changes to this policy

If the app changes what it reads or stores, this page changes with it and the date at the top moves.

On August 25, 2026 this page was corrected. The app had begun keeping a daily record of units sold in order to detect seasons and unusual weeks, and this policy still said that no product or order data was written to disk. It also said that uninstalling removed everything the app held, which was no longer true of that record. Both statements are now accurate, and the deletion the second one described has been implemented.

On September 2, 2026 this page was corrected again. The app had gained suppliers, purchase orders and stock counts, and this page still said that inventory levels were never written to disk — those features necessarily keep the quantities the merchant orders and counts. The deletion routine had also not been extended to the new tables, so ashop/redact would have left them behind. Both are fixed, and the same mistake has now been made twice: a feature that stores something new has to change this page in the same commit.

On August 31, 2026 the weekly email was added, and the line saying this app sends no email to merchants stopped being true. It was changed here before the first message could be sent, rather than afterwards.

Contact

Questions about this policy or about data handling: hjuhyun35@gmail.com