SafeOptions — Privacy Policy

Effective 4 August 2026

SafeOptions is a Shopify app operated by Sognora. It adds customer input fields (such as an engraving message) to your products, and checks every order to confirm those fields actually arrived on it. This policy describes what the app stores about your shop and about the orders it checks, and what it deliberately does not store.

For the shop data described below, Sognora acts as your service provider and processes it on your instructions to operate the app.

1. What the app stores

• Shop and installation. Your myshopify.com domain, whether the app is currently installed, and the result of the last publish of your option sets to your storefront (including an error summary when a publish failed).
• Staff session. The session record defined by Shopify's session storage contract, which holds the access token Shopify issues to this app and the limited staff fields Shopify supplies with it.
• Your option sets. The definitions you create — set name, and for each field its key, label, type, choices and whether it is required — together with the products or collections you apply them to.
• Order checks. For each order the app checks: the Shopify order id and order name (for example #1007), which of your option sets applied, the verdict, which of your own field keys were missing, the time of the check, and the delivery state of any alert.
• Alert settings. The email address you enter on the Settings screen and whether alerts are switched on.

2. What the app deliberately does not store

• No customer identity. No buyer names, email addresses, phone numbers, or shipping or billing addresses. Shopify's order webhook contains buyer details; the app reduces each order in memory to its line items, product ids and option field keys, and writes only that reduced form to its database.
• No option values. The app records that a required field such as engraving_text was missing, never what a buyer typed into it. Checking is a comparison of field keys, so the values are read once in memory and never stored, queued or emailed.
• No payment details. The subscription is billed by Shopify; the app never receives card information.

3. Permissions the app requests

The app requests 3 access scopes and no others:

• read_products
• write_products
• read_orders

The product scopes are used to read your catalog, so you can choose which products and collections an option set applies to, and to publish your option-set definitions to an app-owned metafield that your theme reads in order to draw the fields. The app does not create, edit or delete your products; the only write it performs is to that one metafield on its own app installation. The order scope is used to receive the order-created webhook and to re-read recent orders when a webhook was missed, which is how every order gets checked.

4. Alert emails

When an order arrives without an option it should have carried, the app emails the address you configured, from shin@sognoragroup.com. Delivery is handled by Resend, acting as our email processor. The message contains the order name, the field keys that did not arrive, the time of the check and a link to the order in your Shopify admin — never a value a buyer typed, because the app does not hold one.

5. Retention and deletion

• Data is kept while the app is installed, so that your option sets and your history of order checks remain available to you.
• On uninstall, checking and alerts stop immediately and the session is removed. Shopify sends its shop/redact request 48 hours later, and that request deletes everything the app holds for your shop: order checks, option sets and their assignments, alert settings, install record and sessions.
• A customers/redact request deletes the order-check rows for the orders named in it.
• A customers/data_request is answered from those same rows, which contain an order id, an order name, a verdict and your own field keys — and no customer identity.

6. Sub-processors and disclosure

• Shopify — the platform the app runs on and receives its data from.
• Fly.io — application hosting.
• Supabase — the PostgreSQL database.
• Resend — delivery of the alert emails described above.

Shop data is not sold, is not used for advertising, and is not used to train machine-learning models. It may also be disclosed where the law requires it, or to protect the service and its users.

7. Security and location

Data is encrypted in transit over HTTPS. This app's data lives in its own PostgreSQL schema, reached by a database role that has no access to any neighbouring app's data. Credentials are held as deployment secrets and are kept out of application code. The application is operated from the United States, so data may be transferred there from your country.

8. Your choices and requests

You can switch alerts off or change the alert address on the Settings screen at any time, deactivate or delete an option set, or uninstall the app — which starts the deletion described in section 5. You may also ask us to access, correct or delete your data, or object to a particular use of it, and you may complain to the data protection authority in your country. We will confirm that a requester is authorised for the shop before acting.

9. Changes and contact

Material changes will be posted on this page with a new effective date. Privacy questions and requests go to shin@sognoragroup.com. Never include an API key, password or access token in a message to us.

Privacy · Terms · Support