Privacy policy

The short version

• The app reads products, variants, inventory quantities and collections. It never reads orders, customers, discounts, staff accounts or payment details.
• It stores only what sorting needs: your shop’s domain and access token, the collections you turned on, the order of product IDs in them, short-lived job records and a 30-day activity log.
• Uninstalling deletes all of it at once, and Shopify’s shop/redact request deletes it again 48 hours later.
• This website sets no cookies and runs no analytics. If you join the waitlist, we keep your email address to tell you when InStock First opens.

What the app can access

When you install InStock First you approve three permissions: read_products, write_products and read_inventory. With them the app reads your products, their variants and inventory quantities, and your collections (title, handle, sort order and the order of products). It changes only the order of products inside the collections you turn on, and those collections’ sort order setting.

It asks for no other permission and never reads orders, customers, discounts, staff accounts or payment details.

What Shopify tells the app

Shopify notifies the app when products, inventory levels or collections change (products/update, inventory_levels/update, collections/update), when its subscription changes (app_subscriptions/update), when its permissions change (app/scopes_update) and when it is uninstalled (app/uninstalled). The app uses these notices to decide which collections to re-sort and keeps only the product and collection IDs it needs for that. Every notice is checked against Shopify’s signature before the app accepts it.

What the app stores

The same events are also written to our hosting provider’s server logs, which it keeps for a limited time, so we can find and fix problems.

Never stored: customer data, order data, payment details, staff names or staff email addresses. The app works with a shop-level token, so it never receives a staff member’s details.

Shopify’s privacy requests

Shopify sends every app three privacy requests on behalf of stores and their customers. InStock First answers each one:

• customers/data_request, when a customer asks a store for their data: the app holds no customer data, so there is nothing to return. It acknowledges the request and notes it in the shop’s activity log.
• customers/redact, when a store asks to erase a customer’s data: there is nothing to erase. It acknowledges the request and notes it the same way.
• shop/redact, sent 48 hours after a store uninstalls: the app deletes every record it holds for that shop.

When you uninstall

Uninstalling deletes everything the app holds for your shop at once: the token, the collection settings and remembered orders, the jobs and the activity log. Shopify’s shop/redact request repeats the deletion 48 hours later. Your collections keep their current order; to get their previous sort rules back, turn them off in the app before you uninstall.

Billing

The subscription ($7.99 every 30 days after a 7-day free trial) is billed by Shopify through its Billing API. The app never sees payment details.

Where the data is kept

The app runs on Fly.io servers in the United States, with its database hosted for us. These providers handle the data only on our behalf; apart from them, only Tenhatch has access, to run the app and to answer support requests you send.

This website

No cookies, analytics or tracking scripts. instockfirst.com sets no cookies and loads nothing from other companies; its fonts are served from this site.

Server logs. The site is hosted by Vercel. Like any web host, Vercel records standard request logs (IP address, browser user agent, the page requested and the time) to deliver and protect the site, and keeps them for a limited time under its own privacy policy.

The waitlist. If you join the waitlist, we store your email address, that you asked about InStock First, when you joined, and that you ticked the consent box. We use it to email you once when InStock First opens, and again only if you ask. You can unsubscribe from any email, or ask us to delete your address at any time. The list is kept by Tenhatch with our hosting, database and email-delivery providers, who handle it only on our behalf.

Email. If you email us, we use your address and message to reply, and keep them as long as we need to handle what you asked.

Selling and sharing

We do not sell or share personal information or store data, and we do not use it for advertising. If InStock First or Tenhatch gets a new owner, for example through a merger or sale, the app’s data and the waitlist move to that owner, who must keep to this policy. We will post the change here first.

Your choices

You can turn collections off or uninstall the app at any time; uninstalling deletes what it holds. To get a copy of, or delete, what we hold about your shop, your waitlist entry or your emails with us, write to support@tenhatch.com. We answer within 30 days, usually much sooner. People in California have these rights under California law; we give them to everyone.

Children

InStock First is a tool for businesses and is not directed at children under 13. We do not knowingly collect information from children.

Changes

If this policy changes, we post the new version here with a new effective date, and tell installed shops in the app before a change in what the app reads or stores takes effect.

Contact