How Flash Discounts handles data

This policy applies to merchants who install Flash Discounts on their Shopify store, and to shoppers who visit a storefront where Flash Discounts is active. It's provided by the developer of Flash Discounts to meet Shopify's requirements for apps listed on the Shopify App Store.

When a merchant installs the app and configures a flash discount, we store:

• The shop's myshopify.com domain, used as an account identifier.
• The discount code, discount value (percentage or fixed amount), and the countdown window length the merchant sets.
• A Shopify Admin API access token, used only to read and write that discount configuration on the merchant's behalf.

This is stored in the app's own database (Cloudflare KV) and in a Shopify app metafield owned by the app installation. We never see or store the merchant's Shopify account password, billing details, or customer list.

Nothing is sent to our servers about an individual shopper. The storefront offer bar reads the merchant's current discount config (code, value, time window) from a public, non-personal endpoint — the same response is served to every visitor.

To avoid re-showing a deal a shopper has already used or dismissed, the app writes small flags directly to that shopper's own browser (localStorage) — for example, "seen today" or "redeemed" markers keyed to a product ID. These flags never leave the shopper's device and are never transmitted to Flash Discounts or to the merchant.

A companion Shopify web pixel listens for the storefront's own checkout_completed event so it can mark a purchased product as redeemed in that same browser storage. It does not send order details, payment information, or any personal data anywhere — it only writes a local flag in the shopper's browser.

Flash Discounts does not set its own cookies, does not use third-party analytics or advertising trackers, and does not fingerprint devices. The only client-side storage it uses is localStorage, scoped to the merchant's own storefront domain, as described above.

We do not sell, rent, or share merchant or shopper data with advertisers, data brokers, or any third party. Data is used solely to operate the discount feature for the merchant who installed the app. Our infrastructure providers (Cloudflare, for hosting and storage) process data on our behalf under their own security commitments, and never access it for their own purposes.

Shop configuration is kept for as long as the app is installed. When a merchant uninstalls Flash Discounts, we delete the stored access token and, within 48 hours, the shop's discount configuration — matching Shopify's mandatory app-uninstall and shop-redaction webhooks.

Because Flash Discounts does not collect personal data about identifiable shoppers, there is generally no shopper data to access, correct, or delete. A merchant can request deletion of their shop's stored configuration at any time by uninstalling the app or contacting us at the email below. We respond to Shopify's customers/data_request, customers/redact, and shop/redact compliance webhooks automatically.

Data is stored on Cloudflare's infrastructure and transmitted over encrypted (HTTPS) connections. Access tokens are used only for the specific API calls Flash Discounts needs — creating and reading the merchant's discount configuration — and are never exposed to the storefront or to shoppers.

If this policy changes, we'll update the "Effective" date at the top of this page. Material changes affecting how merchant or shopper data is handled will be communicated to installed merchants.

Questions about this policy or how Flash Discounts handles data can be sent to imageapiai@gmail.com.