What ShelfCanary reads from your store, what it keeps, for how long, and what happens when you uninstall it.
Last updated: 10 September 2026
ShelfCanary is a Shopify app that tells a merchant what to reorder, when, and what stock is not selling. This policy describes what it reads from a store, what it keeps, for how long, and what happens when it is uninstalled.
It is written to be checkable. Everything below is a statement about what the software actually does, not a description of what it is permitted to do.
ShelfCanary is built and run by one person, trading as The Herron Haus. Contact: [email protected].
“You” is the Shopify merchant who installs the app. “Your customers” are the people who buy from your store.
The app requests six permissions from Shopify:
| Permission | What it is for |
|---|---|
read_products | Your product and variant list, and current stock counts |
read_orders | Which SKU sold, how many, on what day |
read_all_orders | The same, reaching further back than 60 days |
read_inventory | How many units sit at each of your locations |
read_locations | The name of each location, so a count is not a bare id |
write_discounts | Creating the markdowns you ask it to create |
read_all_orders needs Shopify’s approval, which was granted on the basis of two promises. Both are described below and both are enforced in code.
No information about your customers is read at any point.
The order query names the fields it wants and nothing else: the order’s id and processing date, and for each line, its id, quantity, SKU, variant and product.
It does not request customer records, email addresses, phone numbers, shipping addresses, billing addresses, transactions, or payment details. This is not a promise about intent. The list of forbidden fields is checked by an automated test that fails the build if any of them appears in a query the app sends.
Per product, per day:
If you use purchase orders: your suppliers, what they supply, your orders, and when deliveries arrived, so lead times can be measured rather than typed.
If you start a markdown: which products it covers, the percentage, and the Shopify id of the discount, so the app can end it again.
No raw orders are kept. Order data is reduced to a per SKU per day total during ingest and the original is not stored. There is no order record in the database at all, by design.
When you install the app, Shopify provides a session so the app can act on your behalf. That session includes the first name, last name and email address of the staff account that installed it. This is your own information, or your staff member’s. It is not your customers’.
This is Shopify’s standard session storage and is required for the app to authenticate. It is deleted when the app is uninstalled, along with everything else.
120 days. Sales and stock history older than that is deleted automatically on every run. This is not a target or an intention; it is a delete statement that runs as part of every ingest.
Product, supplier and purchase order records persist while the app is installed, because they describe your catalogue rather than a point in time.
Shopify notifies the app 48 hours after an uninstall. On that signal, everything held for your store is deleted in a single transaction: sales history, stock history, per location stock, products, suppliers, supplier parts, purchase orders, lead time observations, markdown records, queued work, and the session.
Nothing is retained afterwards, and nothing is archived elsewhere.
Shopify requires apps to respond to two requests on a customer’s behalf: a request for their data, and a request to erase it.
ShelfCanary holds no data about any individual customer, so there is nothing to return and nothing to erase. The app receives both requests, records that it received them, and reports that it holds nothing. This is a consequence of the design described above, not a refusal to comply.
The app runs on Railway and stores data in a PostgreSQL database hosted there.
No data is shared with any third party. There is no analytics service, no error tracking service, no advertising, and no data sale. Nothing leaves the app except the requests it makes to Shopify’s own API on your behalf.
If that changes, this policy changes with it, in the same release.
Data is processed and stored in the region Railway hosts the application in. ShelfCanary does not operate its own hardware.
One thing, and only when you ask for it: an automatic discount, created through Shopify’s own API, when you start a markdown on the dead stock screen. You choose the products and the percentage, you are shown exactly what will change before it is applied, and you can end it from the same screen.
The app makes no other change to your store, your products, your prices or your orders.
You can uninstall at any time, which erases everything as described above. You can ask what is held for your store, or ask for it to be deleted sooner, by writing to [email protected].
Depending on where you are, you may have additional rights over personal data under laws such as the GDPR or the CCPA. The only personal data this app holds is the installing staff account’s name and email, described above.
This policy is versioned with the app’s source code. Material changes will be described here with the date they took effect. The current version is always the one at this address.
Structure adapted from the Basecamp open-source policies, CC BY 4.0. Changes were made: the sections describing signups, billing, cookies and marketing were removed, and the content of every remaining section was rewritten for a Shopify app that reads order data.