Privacy Policy

Effective date: 2026-09-13

This policy explains what the CatalogDrift app accesses when you install it on your Shopify store and connect your Google Merchant Center account, how the data is used and protected, how long it is kept, and how you can revoke access at any time.

Who we are and what this covers

CatalogDrift is a read-only monitoring app that compares your Shopify product catalog with your Google Merchant Center account and reports differences as incidents. This policy covers the app itself and its public website. Questions or requests: messikazi2121@gmail.com.

Data we access from Shopify

• Product catalog data: products, variants, prices, availability, and publication status. The app requests only the read-only read_products permission. It does not request access to customer, order, or payout data.
• Store information: your shop domain, needed to identify your store and receive Shopify app events (for example product-change and app-uninstall notifications).
• Store owner email address: the email address Shopify reports for the store owner, used as the default destination for incident alert emails. You can turn alert emails off at any time in the app's notification settings.

Data we access from Google Merchant Center

• Account information: the Merchant Center accounts your Google login can access (account IDs, names, and statuses), so you can choose which account to monitor.
• Product and status data: the items Merchant Center holds for the selected account and their item-level processing and approval statuses, so they can be compared against your Shopify catalog.

Google access uses OAuth 2.0 with your own Google account. The app only reads Merchant Center data through this connection; it does not modify your Merchant Center account. You can review and revoke the app's access in your Google account settings at any time.

Our use of Google API user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

How we use data

• Comparing your Shopify and Merchant Center catalogs and reporting differences to you inside the app.
• Sending incident alert emails to your notification recipient when your alert settings allow it.
• Operating and securing the service: keeping service records, detecting abuse, and keeping a security audit log (see below).

We do not sell your data and we do not use it for advertising. The app and this website contain no advertising, analytics, or third-party tracking scripts.

Email alerts

Alert emails are sent through Resend, an email delivery service, to the notification recipient configured in the app (by default the Shopify store owner email). Emails are service communications about incidents in your own catalog. We do not send marketing emails.

Storage, security, and service providers

• Authorization happens server-side. Shopify and Google access and refresh tokens are exchanged and stored on the server, never in your browser, and are encrypted at rest with authenticated AES-256-GCM encryption.
• The service runs on Railway cloud hosting with a managed PostgreSQL database hosted by Neon. These providers, and the Resend email service, process data for us on our instructions. Data is stored outside Canada (United States infrastructure). When you use Shopify and Google Merchant Center, their own terms and privacy policies also apply.
• Catalog comparisons and incident records are stored in the app database so findings can be tracked over time.
• For security monitoring of the app itself, the app keeps a security audit log of administrative events. For two kinds of security boundary events, this log includes a one-way hashed (not plain) network identifier. It is not used to identify you or your customers.

Cookies and sessions

The embedded app uses a Shopify session cookie so Shopify can identify your admin session, and a short-lived technical cookie during the Google connection flow so the callback can be matched to your store. These are functional cookies only. Public pages use no cookies.

Retention and deletion

• While the app is installed: catalog snapshots and detailed comparison evidence are automatically deleted after about 90 days; incident records remain while your store history is available under your plan; service records such as webhook receipts and email delivery records are automatically deleted after 60 to 90 days; security audit records are kept for about 180 days.
• When you disconnect Google: the app revokes its authorization with Google and deletes the stored Google tokens immediately. Your incident history remains.
• When you uninstall the app: processing for your store stops, your stored Shopify session tokens are deleted, and the stored Google credentials are deleted immediately. Remaining store data (catalog data and incident records) is erased when Shopify sends the store erasure notification that follows app uninstall, which Shopify delivers normally within 48 hours. Shopify's compliance framework expects erasure to complete within 30 days.
• Compliance notifications: we receive and record Shopify's mandatory customer data request and erasure notifications. These records identify the request itself; they do not store the customer data described in the request.

Your choices and requests

• Disconnect Google at any time from the app's Google Merchant Center settings page in Shopify.
• Turn off alert emails in the app's notification settings.
• Uninstall the app from your Shopify admin to stop all processing and trigger the erasure described above.
• To access, correct, or delete data associated with your store, contact us at messikazi2121@gmail.com. We respond to verified requests within a reasonable period and no later than 30 days.

Complaints

If you have a privacy concern about how we have handled your information, contact us first at messikazi2121@gmail.com so we can try to resolve it. You also have the right to complain to a privacy regulator; in Canada, that includes the Office of the Privacy Commissioner of Canada.

Changes to this policy

We may update this policy as the service evolves. Changes are posted on this page with a new effective date.

Contact

Questions about this policy or your data: messikazi2121@gmail.com.