What the app reads, what it keeps, and what it never does.

At installation Shopify shows the one permission the app requests. It is the only access the app has:

• Products (read_products): product titles, descriptions, images, options, variants, SKUs, barcodes, prices, vendors, product types, tags and collections, to build the line sheet. Shopify also gives this permission access to your B2B catalogs and their price lists, which the app reads when you choose a price list as the price source.

The app does not request, and therefore cannot read, customers, B2B companies, orders, draft orders, checkouts, inventory levels, discounts, staff accounts or payouts. It has no write permission, so it cannot change anything in your store. It requests no access to your storefront and adds nothing to your theme.

The app keeps the following in its database, for your store only:

• Your store's identity: its .myshopify.com domain, and the store-level access token (with its refresh token) that Shopify issues at installation so the app can act for your store. The token belongs to the store, not to a person.
• Settings: brand name, brand colour, logo URL, footer note, default contact and terms for cover pages, paper size and how currency is shown, and when the app was last installed or authorised.
• Each line sheet: its name, whether it is active or archived, a version number, and one document holding its settings: the products on it (as Shopify product ids) in their sections and order, the price source (and the chosen price list's id, name and currency), the layout, the columns shown, and the cover page's title, season, contact and terms. Also its creation, update and archive times, and a random id for the browser tab that saved it last, so the editor can tell its own saves from someone else's.
• Minimum order (MOQ) and case pack per product id, so a product added to a new sheet starts with the values it had last time.
• Each share link: its label, a keyed hash of the link's code and an encrypted copy of it (so you can copy the link again), the hash of its access code if it has one, its expiry date, when it was created and turned off, the number of times its page was opened and its PDF downloaded, when it was last opened, and the prices saved on it: each variant's wholesale and retail price, the product ids they cover, and the date they were set.

Product titles, descriptions and images are not stored in the database. The app reads them from Shopify when a sheet is edited, previewed, exported or opened, and keeps them in memory for a few minutes (up to 10 minutes for share links) so pages load quickly. A share link's PDF is kept in memory for up to 5 minutes so several buyers opening the same link don't each wait for a new one. Whether your store has an active plan is read from Shopify and kept in memory for one minute; it is not written to the database.

While you edit, the editor keeps your latest unsaved changes in your own browser's local storage until the server confirms the save, so a reload or a dropped connection doesn't lose them. That copy stays on your device.

• Customer data. None. The app has no permission to read customers, companies or orders, and no field in its database could hold them.
• Staff identities. The app signs in at the store level. It does not use per-person logins, so it does not store the Shopify account id, name or email of whoever is using it.
• Buyer identities. Buyers don't have accounts and are never asked for a name or email. Section 5 explains exactly what a visit to a share link leaves behind.

About the contact and terms text. The cover page's contact block and terms are free text you write, and they are shown to anyone who has a share link to that sheet. If you type a person's name, email address or phone number there, it is stored as typed and shown to buyers until you change it or your store's data is deleted under section 9.

Buyers who open a share link don't sign in and don't give the app their name or email. The app sends them only the parts of the sheet you chose to show, and it records the following about visits:

• Counts, not people. For each link the app stores the number of times its page was opened, the number of times its PDF was downloaded, and the time it was last opened. It does not store who opened it or where from.
• Request log. The app's own log records, for each request, the method, the page address with the link's code replaced by a placeholder, the response status and size, and how long the answer took. It does not record IP addresses. The web server in front of the app keeps no access log. Its error log can note a request it could not pass to the app, including the visitor's IP address; that log is limited in size and its oldest lines are overwritten as it fills.
• IP address, only on links with an access code. To limit guessing, the app allows 10 wrong codes per visitor on a link in 15 minutes, and 100 on a link from everyone together. When someone submits a code, the app tells visitors apart by their IP address as the web server in front of the app passes it on (for an IPv6 address, only the first half, the /64 network). It keeps that address, as it is and not hashed, in the app's memory with a count of tries for that link. It is never written to the database, to a log or to a backup. The count stops applying 15 minutes after the first try; a right code removes the address at once; old entries are cleared from memory once there are more than 20,000, and all of them are lost when the app restarts. On a link without an access code, the IP address is not used.
• One cookie, only after a right code. When a buyer enters the right access code, the app sets one cookie in their browser, named lf_access_ followed by the link's id. It holds an expiry time and a signature, nothing about the buyer. It lasts 7 days, can't be read by scripts on the page, and is sent only to share pages. The app sets no other cookies on share pages and uses no analytics or tracking.
• Images and font from Shopify. Product images, your logo and the page's font load from Shopify's servers (cdn.shopify.com), so the buyer's browser fetches them from Shopify directly. The page tells the browser not to send the page address to those servers, and asks search engines not to index it.

The app and its database run on a single server that TELCOMA rents from OVHcloud, in its Beauharnois data centre in Quebec, Canada. The database is a file on that server's disk. A copy of it is made every night and kept on the server for 14 days, and OVHcloud also makes an automatic daily backup of the whole server as part of the hosting plan. All traffic between your browser, the app and Shopify, and between buyers' browsers and the app, is encrypted with TLS.

Your data leaves that server only to go to Shopify's own systems, when the app reads your products and price lists through Shopify's Admin API, and to the browsers of people who open your share links.

• It does not change anything in your store. It has no permission to.
• It does not take orders or payments from buyers, and buyers can't create accounts.
• It does not use your data for anything other than running the app for your store and answering your support requests.
• It does not sell, rent, share or transmit your data to any third party.
• It does not email you or your buyers. Billing emails come from Shopify; anything else comes only in reply to a message you sent us.

Everything in section 3 is kept for as long as the app is installed, so that your line sheets and share links keep working.

• When you uninstall, the app deletes your store's access token at once, and every share link stops opening. Your line sheets, settings and links are kept for 48 hours in case you reinstall. Shopify then sends a mandatory deletion request (shop/redact), and the app erases everything it holds for your store. If you reinstalled within those 48 hours, nothing is erased and you find everything as it was.
• Archiving or deleting a line sheet: an archived sheet keeps everything, and its links are paused until you restore it. Deleting an archived sheet removes it and all its share links from the database at once.
• On request, email [email protected] from an address at your store and we will delete your store's data, or send you a copy of it, within 30 days.
• Backups: a copy of the database is made every night and kept on the server for 14 days, and OVHcloud keeps a shorter-lived daily backup of the whole server, so deleted data can remain in a backup for up to 14 days after deletion, after which it is gone.
• Shopify's privacy webhooks for customer data requests and customer data erasure are implemented and acknowledged. Because the app holds no customer data, there is never anything to return or erase.

PDFs you or your buyers downloaded are files on those devices; the app can't recall them. Support emails stay in our support mailbox.

• The app is served over HTTPS only, and every request from the admin carries a Shopify session token that the app verifies before doing anything.
• Every database query is scoped to the store making the request; one store cannot reach another store's sheets or links.
• Webhooks from Shopify are verified with Shopify's signature before they are acted on.
• A share link's code is 32 random bytes. The database holds only a keyed hash of it and an encrypted copy, so someone holding only the database could neither use nor forge a link. Access codes are stored as salted hashes, never as typed.
• Share pages carry only the columns you turned on. They are not indexed, not cached, and send no referrer.
• The server fetches product images and logos only from Shopify's image servers (cdn.shopify.com). A logo address that points anywhere else is refused.
• Shopify credentials, and the key that protects share links, are kept in a file on the server that only the account running the app can read, not in the code. The server accepts logins by key only, and access to the server and database is limited to the TELCOMA staff who operate the app.

Security issues may be reported to [email protected]; please do not post them publicly.