The short version
- Your Stocky API key is never stored.It is sent from your browser to Shopify's Stocky API through our server for the duration of a single export request, then discarded from memory. We never write it to a database, a log, or any analytics record.
- Your exported data is never stored. The ZIP file is generated on the fly and streamed straight to your browser. We keep no copy of your suppliers, purchase orders, or stock records.
- We do not use cookies and we do not run advertising or cross-site tracking.
What we collect
We collect only two narrow categories of data:
- Your email address— only if you choose to enter it in an email updates form. We also store the page context ("source", e.g. which guide you came from) so we understand which content is useful. We do not collect your name or any other personal detail.
- Anonymous usage events — for example, that a sample export was downloaded, that an export attempt succeeded or failed, or that a form was submitted. These events contain only counts and status codes. They never include your store name, your API key, your email, or the contents of your data.
For aggregate page-view statistics we use Vercel Web Analytics, which is cookie-less and does not track you across other websites or build a personal profile.
Why we collect it
- Email: to remind you as the Stocky shutdown deadline (31 August 2026) approaches and to send occasional updates about the RestockLoop app (available on the Shopify App Store). That is the only reason. Every email includes a one-click unsubscribe.
- Anonymous events and page views: to understand whether the tool works and which guides are helpful, so we can improve it. We rely on data minimisation and purpose limitation — we collect the least we can and use it only for these purposes.
How long we keep it
We keep your email address until you unsubscribe or ask us to delete it, at which point it is removed promptly. Anonymous usage events are kept for up to 24 months and then deleted or aggregated. Your API key and exported data are not retained at all — they exist only in memory during your request.
Who processes your data (sub-processors)
We use a small number of trusted infrastructure providers to run the service:
- Vercel — hosting of the website and its serverless functions, plus cookie-less Web Analytics.
- Neon — the Postgres database where your email address (if you subscribed) and anonymous usage events are stored.
These providers process data on our behalf under their own security and data-protection commitments. We do not sell your data to anyone.
The RestockLoop Shopify app
If you install the RestockLoop app from the Shopify App Store, the app connects to your store via the Shopify Admin API with read access to products, inventory, locations and orders, plus write access to inventory used only when you receive a purchase order or record a stock adjustment.
What the app stores:product and inventory snapshots, aggregated daily sales totals per product (a rolling ~60-day window), the suppliers, purchase orders and settings you create, and your store's name and address (for PO documents). What it never requests or stores: customer personal data — no customer names, emails, phone numbers or addresses are ever queried, stored or displayed.
Retention and deletion:all of your store's data is deleted immediately and automatically when you uninstall the app, and again on Shopify's shop/redactprivacy webhook. The app also implements Shopify's customers/data_request and customers/redact webhooks; because no customer personal data is stored, there is nothing to return or erase, and we respond accordingly.
Sub-processors for the app: Vercel (application hosting), Neon (Postgres database, encrypted at rest; all transport over TLS) and — only if you use the email-PO feature — Resend, which delivers purchase-order emails to the supplier addresses you provide. Billing is handled entirely by Shopify; we never see your payment details. We do not sell or share any of this data.
Your rights and how to request deletion
Under the GDPR (EU/UK) and the KVKK (Türkiye), and similar laws elsewhere, you can ask us to access, correct, or delete the personal data we hold about you (which is limited to your email address and its source). To make any such request — or simply to have your email removed — email us at privacy@restockloop.com and we will act on it promptly. You can also unsubscribe from any notification email with one click.
Cookies
We do not set tracking or advertising cookies. Vercel Web Analytics is cookie-less by design.
Changes to this policy
If this policy changes, we will update the date at the top of this page. Because this is a small, free tool with a limited lifespan (tied to the Stocky shutdown), changes are expected to be rare.
Contact
Questions about privacy? Email privacy@restockloop.com.