Privacy policy

Last updated October 20, 2026

Heartlist: Wishlist & Alerts (“the app”) is a Shopify app operated by Emirhan Ozsoy (“we”). It lets shoppers save products to a wishlist on a Shopify store and lets the store send them back-in-stock and price-drop alerts. This policy explains what data the app handles, for merchants who install it and for shoppers on their stores.

Data we receive about merchants

• The store’s myshopify.com domain.
• Access tokens that Shopify issues so the app can read products and inventory. Tokens expire and are refreshed; they are used only to provide the app’s features.
• The app’s settings for the store, such as which alerts are turned on.

The app can read products and inventory only. It cannot read or change orders, payments, customers’ names, email addresses, phone numbers or addresses, and it never touches checkout.

Data we process about shoppers

We process shopper data on behalf of the merchant, who decides how it is used.

• Logged-in shoppers: their Shopify customer ID (a number), the products and variants they saved and when, and a private link token if they share their list.
• Alerts: a record of each back-in-stock or price-drop alert, with the customer ID, product, old and new price, and date.
• Guests: a guest’s wishlist stays in their own browser (local storage) and is not sent to us unless they log in, when it is added to their account.

We do not collect shoppers’ names, email addresses, phone numbers, addresses or payment details. Alerts are handed to Shopify Flow, and the merchant chooses what happens next, such as sending an email with Shopify Email. Shopify only sends marketing email to customers who agreed to receive it.

How we use data

Only to provide the app: to store and show wishlists, send alerts the merchant has turned on, and show the merchant each customer’s saved products (by Shopify customer ID) and totals such as their most wished-for products. We do not sell data, use it for advertising, build profiles, or share it with other merchants.

Who we share data with

• Shopify, through its APIs and Shopify Flow, to provide the app’s features.
• Our hosting and database providers, who store data for us under contract and may not use it for anything else.
• Authorities, if the law requires it.

Cookies and browser storage

The app sets no cookies and uses no tracking. On the storefront it uses the browser’s local storage for a guest’s wishlist and session storage to cache a logged-in shopper’s list for a few minutes.

How long we keep data

• Wishlists are kept while the app is installed.
• Alert records are deleted after 180 days.
• When Shopify asks us to erase a customer’s data, we delete their wishlist and alert records.
• When a merchant uninstalls the app, we delete the store’s access tokens at once and all of the store’s data when Shopify asks us to, 48 hours later.
• Our hosting provider may keep standard request logs, which include IP addresses, for up to 30 days for security and troubleshooting.

Your rights

Shoppers can see and remove their saved items on the store’s wishlist page at any time. To access or delete their data, shoppers should contact the store, which can make a request through Shopify; we act on every data and erasure request Shopify sends us. Merchants can contact us directly.

Security

Data is encrypted in transit and stored with providers that encrypt it at rest. Every storefront request to the app is signed by Shopify and checked, and the app only accepts the shopper identity that Shopify provides. The code that runs on storefronts is delivered by Shopify as part of the app’s theme extension.

Changes

We will post any changes on this page and update the date above. If a change affects how merchants’ data is used, we will tell merchants before it takes effect.

Contact

Questions about privacy: support@heartlistwishlistalerts.app