Privacy policy

We do not ask Shopify for access to your customers or your orders, and we could not read them if we wanted to. We store what your store looks like from the outside — the pages we checked and the problems we found — plus enough about your account to bill you and email you.

• Your Shopify store address, store name, and the email on your Shopify account.
• Access tokens that let us read your product, page and theme lists. These are what Shopify issues when you install; they expire and are refreshed automatically.
• Your plan, and whether your subscription is active. We never see your card.
• The results of every check: which pages we looked at, what we found, when each problem first appeared, and when it was fixed.
• Your dated record, which is designed so that it cannot be edited after the fact.
• Any contact email you enter for alerts and for your public statement page.
• If your store is password-protected and you choose to give us the password, we store it encrypted. You can delete it at any time from Settings, and we never display it back to you.

We request only three permissions from Shopify: read your products, read your pages and policies, and read your themes. We do not request access to customers, orders, checkout, or payment information, so none of that reaches us. If Shopify sends us a customer data request under GDPR, our honest answer is that we hold nothing about that person, and that is what we reply.

Anyone can check a single page at curbcut.site/scan without an account. We fetch the address you enter, look at the page, and return the result. We do not keep the address or the result, and we do not build a record from it.

We use a small number of service providers, and only these. Each one is bound by its own data-processing terms.

• Vercel — runs the application. Requests are served from the United States.
• Supabase — the database, hosted in the United States.
• Resend — sends the emails described below.
• Shopify — handles all billing and issues the permissions above.

We do not sell your data, we do not share it for advertising, and we do not use it to train anything.

Only about your own store: an alert when a check finds something new, a copy of every report you create, and — if you uninstall — your complete record as an attachment before it is deleted. There is no marketing list. You can turn off change alerts by clearing the contact email in Settings.

The marketing site sets no cookies and runs no analytics or advertising trackers. Inside the Shopify admin, a short-lived cookie is used during installation to protect against request forgery, and Shopify itself manages the session.

While Curbcut is installed, we keep your record for as long as you have an account — that is the point of it. When you uninstall, Shopify tells us, and we immediately delete the access tokens.

About 48 hours later Shopify asks us to delete the store's data, and we do: your checks, findings, issue history and reports are removed, and your store identity is anonymised. Before any of that happens we email your complete record to you as an attachment, so you keep a copy. Reinstalling after that starts a new record.

Depending on where you live — including under the GDPR in the UK and EU, and the CCPA and CPRA in California — you may have the right to see the data we hold about you, correct it, have it deleted, receive a portable copy, or object to how we use it. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.

To exercise any of these, email support@curbcut.site. We reply within 30 days, and we will not charge you or treat you differently for asking. Uninstalling Curbcut from your Shopify admin also triggers deletion, as described above.

Access to the database is server-side only and restricted to the application itself. Requests from your Shopify admin are authenticated with signed tokens issued by Shopify, and every webhook we receive is verified before we act on it. Stored store passwords are encrypted. If you believe you have found a security problem, email support@curbcut.site with [SECURITY] in the subject; we acknowledge within two business days.

Curbcut is a business tool for store owners. It is not directed at children and we do not knowingly collect data from anyone under 16.

If we change this policy we will update the date at the top, and for anything material we will email installed merchants rather than relying on you to check.