Privacy Policy

Last updated: May 26, 2026  ·  Membership Card App

This Privacy Policy describes how the Membership Card Shopify app ("the App", "we", "us") collects, uses, and handles information when you install and use the App through the Shopify platform.

1. Information We Collect

When you install the App, we collect and store the following information necessary to provide the service:

• Shop domain — used to identify your store and associate your settings with it.
• OAuth session tokens — issued by Shopify to authenticate API requests on your behalf. Stored securely and never shared.
• Card settings — the card title, member number source preference, and QR code toggle you configure in the App.
• Rank settings — the customer tags, icons, labels, and priority order you configure for your membership ranks.

2. Customer Data

The App displays membership cards to your customers on their Customer Account profile page. To render a card, it temporarily reads the following data from Shopify's Customer Account API at the time a customer views their profile:

• Customer first name and last name
• Customer ID (used as membership number if configured)
• Customer tags (used to determine membership rank)
• A single customer metafield (namespace: custom, key: member_number) — only when the merchant has enabled the metafield option

This customer data is read on-demand for display purposes only and is never stored in our database. We do not collect, retain, or process any customer personally identifiable information (PII) such as email addresses, phone numbers, or purchase history.

3. How We Use Information

We use the information we collect solely to:

• Display the correct membership card settings for each store
• Authenticate API requests to Shopify on your behalf
• Provide technical support when you contact us

We do not sell, rent, or share your data with any third parties for advertising or marketing purposes.

4. Data Storage and Security

Your store's settings are stored in a PostgreSQL database hosted on Fly.io (US region). Fly.io is SOC 2 compliant. Data is transmitted over HTTPS at all times.

5. Data Retention and Deletion

Your store's data (card settings and rank settings) is retained for as long as the App is installed. When you uninstall the App, all data associated with your store is automatically and permanently deleted from our database within 48 hours.

In compliance with Shopify's GDPR requirements, we provide the following data request endpoints:

• Customer data requests — we do not store any customer PII, so there is no customer-specific data to provide.
• Customer data erasure — same as above; no customer-specific data is retained.
• Shop data erasure — all shop data is deleted upon receiving this request.

6. Third-Party Services

The App uses the following third-party services:

• Shopify — the e-commerce platform that provides the API and customer account interface
• Fly.io — application and database hosting

7. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Continued use of the App after changes are posted constitutes acceptance of the new policy.

8. Contact

If you have any questions about this Privacy Policy or your data, please contact us at: info@mocrea.site

Membership Card App — Built for Shopify