Privacy Policy

CartGuard

Last updated: September 10, 2026

What data we collect

CartGuard collects only the minimum data required to function as a Shopify app:

• Session tokens — Used to authenticate your Shopify admin session. These are stored securely in our database and automatically expire.
• Product tags and product types — Read from your store via the Shopify API to display configuration options. This data is not stored in our systems.

Customer data used during checkout

When you enable the optional exemption and country rules, the checkout validation reads the following about the shopper at the moment of checkout, purely to decide whether to block the order:

• Whether the shopper carries one of the customer tags you selected
• Whether the shopper is buying on behalf of a business (B2B)
• The country the order is being placed from

This evaluation runs entirely inside Shopify's checkout infrastructure. None of it is transmitted to us, logged, or stored anywhere. We never see it.

What data we do not collect

We do not store or process customer personal data on our own systems. We do not use cookies, tracking pixels, or analytics on your storefront, and we do not build customer profiles.

How data is stored

Session data is stored in a PostgreSQL database hosted on Railway with encrypted connections. Configuration settings (blocked tags, product types, error messages) are stored in Shopify metafields on your store — we do not maintain a separate copy.

Data retention

Session data is automatically deleted when you uninstall the app. Metafield configuration data remains on your Shopify store and can be managed through the Shopify admin.

Pricing and billing

CartGuard is free. We do not collect payment information and there is no paid plan.

Third-party sharing

We do not sell, share, or transfer any data to third parties.

Contact

If you have questions about this privacy policy or want to request data deletion, please contact us at kevin@kwat.me.