Privacy policy

Dernière mise à jour le 22 September 2026 · legal@everstorefront.com

Cette page est publiée en anglais pour que son sens soit exact.

EverStorefront is a tool for designing Shopify themes. This page says what it stores, why, for how long, and how to have it removed. It is written to be read, not skimmed past. The only address for anything on this page is legal@everstorefront.com.

What we hold, and why

• Your account — name, email address, a hashed password (never the password itself), an optional photo, and your chosen app language. Needed to sign you in and address you.
• Your workspace — its name, logo, settings, members and their roles, invitations, the projects and designs you make, your library, the notes on every version, and feedback you send us with any screenshots you attach.
• Connected stores — when a store owner authorises the app through Shopify, we receive an access token for that store together with the scopes granted (read products, read themes, write themes). We use it to import the store's catalogue — product titles, images, prices, availability, collections — and to read or place theme files. We never receive orders, customers or payment details, and we never ask for them.
• Words from a store — if you choose Bring over their words, we read the headline, tagline, announcement and footer text from the store's current theme or public home page and keep them with that store.
• Review links — a label you choose, the reviewer's name and note when they reply, and a snapshot of the design at that moment. Reviewers do not need an account and we do not ask them for an email unless you type one in, in which case it is used once to send the link and not stored.
• Measurements — if you ask for them, the size and script count of a store's public home page, and Lighthouse scores fetched through Google's PageSpeed Insights service for a public address you name.
• Server logs — request paths, timestamps and IP addresses, kept briefly for security and debugging, and used to limit repeated sign-in attempts.

What we do not do

We do not sell or share any of this with advertisers. We run no analytics or tracking scripts in the app. The themes we compile contain no script that calls us: once a theme is in a store, nothing on that storefront talks to EverStorefront.

Cookies

Three, all ours, all essential: a session cookie that keeps you signed in (thirty days with Remember me, otherwise until the browser closes), a cookie remembering which workspace you last used, and one remembering your app language before you sign in. No third-party cookies.

Who else touches the data

• Shopify, which provides the store connection and receives the themes you send.
• Our hosting provider, on whose servers the application and its database run.
• Our email provider, which delivers invitations, handoffs, review links and password resets on our behalf.
• Google PageSpeed Insights, which receives only the public store address you ask us to measure.

Each is bound by its own privacy terms; we send each the minimum it needs.

How long

Account and workspace data stay until you delete them — a workspace can be deleted from Settings, and it takes its projects, library and store connections with it. When a merchant removes the app from a store, the store is marked disconnected at once and Shopify sends a redaction request forty-eight hours later, on which we erase everything held for that store. Demo workspaces created from the log-in page are deleted automatically after twenty-four hours. Backups are kept for fourteen days.

Shopify's requirements

We answer Shopify's mandatory privacy webhooks: requests for a customer's data, requests to erase a customer's data, and requests to erase a store. Because we hold no customer data, the customer requests are acknowledged and logged; the store request is carried out as described above.

Your rights

You can see, correct or delete what we hold about you. Most of it is visible and editable in the app; for anything else, or to close your account entirely, write to legal@everstorefront.com from the address on the account and we will act within thirty days. If you are in the European Economic Area or the United Kingdom you also have the right to complain to your data protection authority.

Changes

If this page changes in a way that matters, the date at the top changes and the changelog says so.