Privacy Policy

What this app stores

Giveaway Box lets you run a buy-to-enter giveaway: paid orders earn entries, and you draw a winner. The app keeps the following, keyed to your shop domain:

• Your giveaways: the name, the prize, the start and end dates, how orders earn entries, the link to your official rules, and, after a draw, the draw record (the seed, a fingerprint of the entries, and the winning entry).
• An entries ledger: for each entry, the order ID and order number it came from, the customer ID if the customer was logged in, the number of entries, and when it happened. Free entries and entries you add by hand carry only the customer ID.
• Your plan, the price you signed up at, and how many orders earned entries each month.
• An access token issued by Shopify when you install the app, used to read paid orders, refunds, and cancellations.
• In your store's app data on Shopify (not on our servers): the running giveaway's name, how orders earn entries, and its dates, so the line on your product pages can show without calling our servers. It holds no customer data. The app clears it when you end or draw the giveaway, and the line stops showing once the giveaway's end date passes.

What this app does not collect

From orders, the app reads only the order ID, order number, customer ID, the product subtotal after discounts, whether it is a test order, and when it was created. From refunds and cancellations it reads only the refund ID, the order ID, and the product subtotal that was refunded, to take back entries. It does not read or store customers' names, email addresses, postal addresses, or phone numbers.

The storefront part of the app sends no customer ID to our servers: logged-in customers are identified only by the signed request Shopify makes on their behalf.

To slow down abuse, requests from the storefront widget are rate-limited by network address. That address is kept only in the app's memory, is cleared within a minute after a ten-minute window ends, and is never written to the database. The widget sets no cookies.

We do not receive payment information. Customers pay through your store's checkout.

We do not use your data or your customers' data to train models, and we do not sell or share it.

Who receives it

Shopify, which sends us paid orders, refunds, and cancellations, and through which logged-in customers see their entries.

Railway (railway.com), which hosts the app and its PostgreSQL database in the Netherlands. Railway processes data only to host the service.

There are no other processors. No email service, analytics service, advertising network, or error-reporting service receives your data or your customers' data.

How long it is kept

Giveaways and the entries ledger stay while the app is installed, because they are the record of who entered and who won.

When you uninstall the app, Shopify sends a shop/redact request 48 hours later. On that request we delete everything we hold for your shop.

You can ask for deletion sooner by emailing us.

Requests from customers

If a customer asks your store for their data, the only thing the app holds about them is their entries: order IDs and numbers, their customer ID, and entry counts.

If a customer asks to be deleted, Shopify forwards a customers/redact request. We find their ledger entries by their customer ID and order IDs and delete them; if they were a winner, the draw record keeps that a winner was drawn but no longer says who.

Changes

If what we store changes, this page changes with it before the change ships. The date at the top of this page is the last time that happened.

Contact

Questions, or a deletion request: beobjoong@gmail.com