Privacy policy

Last updated: 2026-10-23

日本語

fixcode (“we”) sets out below how information is handled in the Shopify app “Guardrails” (“the app”).

1. What the app does

The app inspects a merchant’s store settings and reports states that cost them money: a 100% discount left active, products priced at zero, prices below cost, prices missing a digit, regions with no shipping rate, and so on. On the paid plan it can also stop flagged products from being purchased at checkout.

2. We do not collect buyers’ personal information

The app asks Shopify only for read access to discounts, products, inventory and shipping settings (including per-market shipping settings), plus write access to the checkout validation setting. We never request access to orders or customers.

• We do not collect buyers’ names, addresses, phone numbers or email addresses.
• When checkout blocking is enabled, a Shopify Function reads the cart contents (product IDs, quantities, unit prices) to decide whether the purchase may proceed. That runs entirely inside Shopify, is never sent to our servers, and is never stored. No attribute of the buyer is used in the decision.

3. What we store

Our database holds only the following merchant information.

• Shop domain and the access token issued by Shopify
• Check results (rule name, the identifier of the product or discount concerned, title and explanation, when it was first and last seen, when it was resolved, whether it was marked intentional)
• Notification history (subject, body, when it was sent)
• Store response times (for availability monitoring)
• Settings (selling countries, currency, display language, plan, checkout blocking configuration)

4. Why we use it

• To inspect store settings and report the results (reports are shown in the app)
• Monitoring: the operator receives an email with only the store domain, the number of findings and the rule types. Store contents such as discount names, product names, prices and costs are not included
• To stop flagged products at checkout (paid plan only, and only when the merchant turns it on)
• To investigate and fix failures

We use it for nothing else. Never for advertising, marketing, analytics, or as training data. We never sell or share it with third parties.

5. Third-party services

• Shopify Inc. (Canada): reading store settings, app authentication, billing
• Cloudflare, Inc. (USA): our runtime, database and the operator monitoring email. The database is pinned to the Asia-Pacific region, but storage within any particular country is not guaranteed.

6. Security measures

• All traffic is encrypted (HTTPS). The database is encrypted at rest.
• We request the minimum permissions needed. We never request order or customer read access.
• Only the operator can access the servers and the database.
• Webhooks from Shopify are verified by signature before they are acted on.

7. Retention and deletion

• Check results are kept until they are confirmed resolved.
• When the app is uninstalled, the access token is deleted.
• When Shopify sends a shop data deletion request (shop/redact), everything held for that shop is deleted.
• Because we never hold buyers’ personal information, a buyer-related deletion request has nothing to delete. We record that fact.

8. Contact