Footnoterizer Privacy Policy

Last updated: July 8, 2026

Who we are

Footnoterizer (“the app”, “we”, “us”) is a Shopify app operated by ¶ pilcrow that lets merchants add footnotes and legal annotations to their Shopify storefront. This policy explains what data the app processes, why, and the rights you have.

Summary

Footnoterizer does not collect or store shopper personal information. The footnote content and placements a merchant creates are stored in the merchant’s own Shopify store. The only data we persist on our own infrastructure is the technical state needed to run the app: the store’s authentication session, short-lived authoring-session state, and a cache of the store’s footnote library. We use no analytics, tracking, or advertising, and we load no third-party scripts on your storefront.

What data we process

• Shopify authentication session. When a merchant installs the app, Shopify issues an access token that lets the app read and write the specific store data the merchant authorized. We store this session (including the shop domain and token) so the app can operate. It is deleted when the app is uninstalled (see Retention and deletion).
• Authoring-session state. While a merchant uses the storefront authoring overlay, the app keeps short-lived, per-store state (for example, records of spent single-use authoring grants and a revocation threshold) to secure the authoring flow. This contains no shopper personal data.
• Footnote library cache. To deliver footnote content efficiently, the app caches the store’s footnote library. The cache is derived from the merchant’s own store data, is refreshed on changes, and contains no shopper personal data.
• Merchant-authored content. Footnote text and placement locations that a merchant creates are stored in the merchant’s own Shopify store (as metaobjects and metafields), not on our infrastructure. This content is under the merchant’s control through Shopify.

What we do not collect

• We do not collect, store, or process shopper (customer) personal information.
• We do not run analytics, telemetry, tracking pixels, or advertising.
• We do not load third-party scripts on your storefront; the app’s storefront code is first-party and isolated.
• We do not sell or share personal information.

Sub-processors

We rely on the following sub-processors solely to operate the app:

• Shopify — the platform the app runs on; provides authentication and hosts the merchant’s store data.
• Netlify — application hosting and the storage layer used for the authentication session, authoring-session state, and the footnote library cache.

We do not use any other sub-processors. No data recipient beyond Shopify and Netlify is involved.

Retention and deletion

• Uninstall. When the app is uninstalled, Shopify cancels the app’s access. Shopify sends a shop/redact request approximately 48 hours after uninstall, at which point the app deletes any remaining authentication sessions for that store.
• Customer data requests. If Shopify forwards a customer data request (customers/data_request) on a shopper’s behalf, we have no shopper personal data to return, because we store none.
• Customer redaction. If Shopify forwards a customer redaction request (customers/redact), there is nothing for us to redact, because we store no shopper personal data.

These obligations are implemented as Shopify’s mandatory GDPR compliance webhooks and are honored automatically.

Your rights

GDPR (EEA/UK)

If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability. Because the app does not store shopper personal data, most requests will confirm that we hold none. For the technical store data we process to operate the app, contact us and we will respond consistent with applicable law. Merchant store data is controlled by the merchant through Shopify.

CCPA/CPRA (California)

If you are a California resident, you have the right to know what personal information is collected, to access and delete it, and to opt out of its sale or sharing. We do not sell or share personal information, and we do not collect shopper personal information. To exercise your rights regarding the technical data we process, contact us using the details below.

International data transfers

Data processed to operate the app is handled by our sub-processors (Shopify and Netlify), which may process data in jurisdictions outside your own. Where required, transfers rely on the safeguards provided by those processors.

Changes to this policy

We may update this policy to reflect changes in the app or legal requirements. Material changes will be reflected by an updated effective date.

Contact

For any privacy question or to exercise your rights, contact us at support@meetpilcrow.com.