The short version
- Your Stocky API key is never stored.It is sent from your browser to Shopify's Stocky API through our server for the duration of a single export request, then discarded from memory. We never write it to a database, a log, or any analytics record.
- Your exported data is never stored. The ZIP file is generated on the fly and streamed straight to your browser. We keep no copy of your suppliers, purchase orders, or stock records.
- We do not use cookies and we do not run advertising or cross-site tracking.
What we collect
We collect only two narrow categories of data:
- Your email address— only if you choose to enter it in a "notify me" form. We also store the page context ("source", e.g. which guide you came from) so we understand which content is useful. We do not collect your name or any other personal detail.
- Anonymous usage events — for example, that a sample export was downloaded, that an export attempt succeeded or failed, or that a form was submitted. These events contain only counts and status codes. They never include your store name, your API key, your email, or the contents of your data.
For aggregate page-view statistics we use Vercel Web Analytics, which is cookie-less and does not track you across other websites or build a personal profile.
Why we collect it
- Email: to notify you as the Stocky shutdown deadline (31 August 2026) approaches and when our paid inventory app launches. That is the only reason. Every email includes a one-click unsubscribe.
- Anonymous events and page views: to understand whether the tool works and which guides are helpful, so we can improve it. We rely on data minimisation and purpose limitation — we collect the least we can and use it only for these purposes.
How long we keep it
We keep your email address until you unsubscribe or ask us to delete it, at which point it is removed promptly. Anonymous usage events are kept for up to 24 months and then deleted or aggregated. Your API key and exported data are not retained at all — they exist only in memory during your request.
Who processes your data (sub-processors)
We use a small number of trusted infrastructure providers to run the service:
- Vercel — hosting of the website and its serverless functions, plus cookie-less Web Analytics.
- Neon — the Postgres database where your email address (if you subscribed) and anonymous usage events are stored.
These providers process data on our behalf under their own security and data-protection commitments. We do not sell your data to anyone.
Your rights and how to request deletion
Under the GDPR (EU/UK) and the KVKK (Türkiye), and similar laws elsewhere, you can ask us to access, correct, or delete the personal data we hold about you (which is limited to your email address and its source). To make any such request — or simply to have your email removed — email us at privacy@restockloop.com and we will act on it promptly. You can also unsubscribe from any notification email with one click.
Cookies
We do not set tracking or advertising cookies. Vercel Web Analytics is cookie-less by design.
Changes to this policy
If this policy changes, we will update the date at the top of this page. Because this is a small, free tool with a limited lifespan (tied to the Stocky shutdown), changes are expected to be rare.
Contact
Questions about privacy? Email privacy@restockloop.com.