Privacy Policy

This policy covers the Order Tracking Shopify app only. It does not cover the StoreFleet website or any other StoreFleet product.

Last updated 18 September 2026 · Data controller: StoreFleet — Phú Nghĩa, Hà Nội, Việt Nam, contact [email protected]

What we store, and why

Permissions the app asks for

The app does two jobs, and part of the permission list below covers both, exactly as it did before. As of 16 September 2026 the install grant also covers a broad range of further Admin API permissions the app does not yet use in any screen. We are asking for them once, at install, instead of asking again every time a new screen ships — the trade-off, stated plainly, is that a merchant installing today grants more than today’s features exercise. Section by section below says which permissions power something live now and which sit unused until a feature that needs them ships. Every permission named here is requested when the app is installed; none of it is optional at install, though a small further set of optional permissions exists in the app’s configuration — covering Shopify Payments account detail and customer merge/erasure tooling — that Shopify does not prompt for unless a feature needing them is turned on, which is not the case today.

Orders, draft orders & checkouts — live

This is what the buyer lookup page and the Orders/Draft orders screens inside Shopify admin already do: look up the order a shopper asked about, and let the merchant view, edit, cancel, refund or process a return on an order without leaving the app. read_all_orders is what lets the merchant see orders older than sixty days; Shopify approves that permission separately before an app may ask for it. The point-of-sale, payment-terms, payment-notification and packing-slip permissions in this group are requested for the same order-management surface but are not yet wired into a screen.

read_orders, write_orders, read_all_orders, read_order_edits, write_order_edits, read_draft_orders, write_draft_orders, read_checkouts, write_checkouts, read_returns, write_returns, read_cash_tracking, write_cash_tracking, read_payment_terms, write_payment_terms, read_payment_notifications, write_payment_notifications, read_packing_slip_templates, write_packing_slip_templates

Disputes & chargebacks — live

The app’s Disputes screen lists the chargebacks and inquiries Shopify Payments has opened against a shop’s charges, and shows one dispute’s full detail — the order it was raised against and the evidence packet already on file, including the buyer’s billing and shipping address, the shipment used to fulfil that order, and any files already attached. read_shopify_payments_disputes is what lets the app read that list and that detail. Shopify resolves the order named on a dispute the same way it resolves any other order lookup, including one that came in through a marketplace sales channel or a point-of-sale quick sale, so reading a dispute’s order needs the same permission those order kinds need elsewhere — read_marketplace_orders and read_quick_sale — whether or not the shop sells through either. This wave is read-only: the app does not submit or edit evidence, and the permission a future evidence-submission screen would need is deliberately left out of what is requested at install. As with every other screen in this section, none of what it reads is written to our database — it is shown to the merchant and discarded.

read_shopify_payments_disputes, read_marketplace_orders, read_quick_sale

Fulfillment & shipping — live

Fulfilling an order from inside the app — assigning it to a location, handing it to a carrier, or routing it to a merchant-managed or third-party fulfillment service — needs permission to read and write fulfillments, fulfillment orders, shipping rates and the locations an order ships from. This is what the app’s order-management screen already does; the custom-fulfillment-service and delivery-customization permissions in this group are not yet wired into a screen.

read_fulfillments, write_fulfillments, read_assigned_fulfillment_orders, write_assigned_fulfillment_orders, read_merchant_managed_fulfillment_orders, write_merchant_managed_fulfillment_orders, read_third_party_fulfillment_orders, write_third_party_fulfillment_orders, read_fulfillment_constraint_rules, write_fulfillment_constraint_rules, read_custom_fulfillment_services, write_custom_fulfillment_services, read_shipping, write_shipping, read_locations, write_locations, read_delivery_customizations, write_delivery_customizations

Products, inventory & gift cards — live

Editing a product, adjusting stock at a location or moving inventory between locations is what the app’s Products screen already does. Product feeds, purchase options and gift cards in this group are requested for the same catalog surface but are not yet wired into a screen.

read_products, write_products, read_inventory, write_inventory, read_inventory_transfers, write_inventory_transfers, write_inventory_purchase_orders, read_product_feeds, write_product_feeds, read_purchase_options, write_purchase_options, read_gift_cards, write_gift_cards, read_gift_card_transactions, write_gift_card_transactions

Customers — live

Looking up and editing the customer and delivery address attached to an order the merchant is working on is what the app’s order-management screen already does. Reading a B2B company or a store-credit balance is requested for the same customer surface but is not yet wired into a screen.

read_customers, write_customers, read_customer_events, read_companies, write_companies, read_store_credit_account_transactions, write_store_credit_account_transactions

Content, online store & the buyer lookup page — partly live

read_files and write_files upload the background image the merchant chooses for their own lookup page, into that shop’s own Content › Files library — the app has one upload endpoint, accepts images only, and never lists or deletes anything else in that library. read_online_store_navigation and write_online_store_navigation add the lookup link to the store menu, only when the merchant presses the button that does it; a merchant who adds the link by hand never triggers this. The remaining permissions in this group — store pages, metaobjects, translations and script tags — are not yet wired into any screen.

read_files, write_files, read_online_store_navigation, write_online_store_navigation, read_content, write_content, read_online_store_pages, write_online_store_pages, read_metaobjects, write_metaobjects, read_metaobject_definitions, write_metaobject_definitions, read_translations, write_translations, read_script_tags, write_script_tags

Discounts & pricing — not yet live

Creating or changing a discount code or an automatic price rule. Requested ahead of a discounts screen that does not exist yet.

read_price_rules, write_price_rules, read_discounts, write_discounts, read_discounts_allocator_functions, write_discounts_allocator_functions, read_payment_customizations, write_payment_customizations

Sales channels & markets — not yet live

Reading and publishing to the sales channels and international markets a shop sells through, and to product listings on each. Requested ahead of a channels/markets screen that does not exist yet.

read_markets, write_markets, read_markets_home, write_markets_home, read_channels, write_channels, read_discovery, write_discovery, read_publications, write_publications, read_product_listings, write_product_listings

Checkout & cart customization — not yet live

Reading and configuring cart and checkout behaviour — cart transform functions, checkout validations, and checkout branding or account settings. Requested ahead of a checkout-customization screen that does not exist yet.

read_checkout_and_accounts_configurations, write_checkout_and_accounts_configurations, read_checkout_branding_settings, write_checkout_branding_settings, read_validations, write_validations, read_cart_transforms, write_cart_transforms, read_all_cart_transforms

Marketing, pixels & analytics — not yet live

Reading store analytics and marketing activity, and reading or installing tracking pixels. Requested ahead of a marketing/analytics screen that does not exist yet.

read_marketing_events, write_marketing_events, read_marketing_integrated_campaigns, write_marketing_integrated_campaigns, read_analytics, read_analytics_annotations, write_analytics_annotations, read_custom_pixels, write_custom_pixels, read_pixels, write_pixels, read_checkout_kit_enhanced_buyer_events

App configuration, compliance & reporting — not yet live

Reading and configuring the app’s own storefront proxy route, reading the shop’s privacy settings and audit trail, and reading or generating reports. Internal to how the app runs rather than a merchant-facing feature, and not yet wired into any screen.

read_app_proxy, write_app_proxy, read_privacy_settings, write_privacy_settings, read_audit_events, read_rollouts, read_resource_feedbacks, write_resource_feedbacks, read_reports, write_reports

How a lookup works

The shopper enters an order number and the email address on that order, on a page served under the merchant's own domain. We query Shopify with the shop's token, compare the email against the order, and render the status. If either the order number or the email does not match, the answer is identical in both cases — deliberately, so that nobody can use the form to discover which orders exist.

Erasure

• On uninstall — the installation is marked disconnected and the stored tokens are overwritten immediately, so the app can no longer reach the shop.
• On shop/redact (Shopify sends this 48 hours after uninstall) — the shop domain, shop name, tokens, settings and any data-request records are deleted.
• On customers/redact — any data-request record naming that customer is deleted. Since no other buyer data is stored, there is nothing else to erase.

Sub-processors

• Shopify — the source of every order we display.
• Cloudflare — serves the app's domain and terminates TLS.

No analytics, advertising or session-recording service runs on the app's surfaces. Buyer data is never sold, rented or shared.

Your rights

A shopper who wants to know what a shop holds about them should ask that shop — the merchant is the controller of their order data, and Shopify's own request mechanism reaches us automatically. A merchant may email us at any time to have their shop erased without waiting for the 48-hour window.