TreStack Follow the build

Legal

Privacy policy

How TreStack Timer collects, uses, and shares information when you install and use the app, and what it keeps about the shoppers on your store.

TreStack Timer ("the App") adds countdown timers to Shopify stores: on product pages, in a bar across the store, on collection pages, in the cart, and in emails. It is built by TreStack ("we", "us") and runs at timer.trestack.app. This privacy policy describes how personal information is collected, used, and shared when you install or use the App in connection with your Shopify store, and when you visit trestack.app.

When you install the App, we are given access to certain information from your Shopify account through four access scopes: read_products, to let you choose the products and collections a timer shows on; read_themes, to check that the app embed is turned on; write_files, to upload timer background images to your own Shopify Files; and read_locales, to translate timer text into your store's languages. The App has no access to your orders, your customers, or payments.

From your store we keep your shop domain, store name, contact email, timezone, and main language; an encrypted access token; your plan and subscription status as Shopify reports it; the settings of each timer you create; records of the images you upload; and daily totals per timer of views, clicks, closes, and completions. If you contact us or downgrade your plan, we also keep your message or the reason you give.

We do not collect any personal information about your shoppers. No shopper names, emails, addresses, or order details reach us, and no profile of any visitor is built.

If you use the contact form on trestack.app, we receive the name, email address, store address, and message you enter. They reach us as one email in our support inbox and are not stored in any database.

  • Browser storage: on your storefront the App sets no cookies. It keeps a few values in the shopper's own browser: local storage remembers when a per visitor countdown started and whether a bar was closed, and session storage stops one visit from being counted twice. These values never leave the browser
  • Count events: when a timer is seen, clicked, closed, or reaches zero, the storefront sends a small event to timer.trestack.app with the timer id, timer type, store domain, and kind of event, and no shopper identifier
  • Email timer images: an email timer is an image loaded from timer.trestack.app when the email is opened. Its address holds only the timer id, with no cookie and no per recipient identifier
  • Log files: like any web server, ours records the IP address, browser type, and time of each request. We use this only to run and secure the service, never to identify shoppers, and it is deleted after about 14 days
  • On trestack.app there are no analytics, and the site itself sets no cookies. It loads its fonts from Google Fonts, and the contact page loads Cloudflare Turnstile, which checks the browser to block spam before a message is sent

We use the information collected from your store to provide the App and operate it: to show your timers where and when you set them, to apply your plan and its monthly view limit, to show you each timer's counts, to answer your support requests, and to keep the service secure.

We may write to your store's contact email about the App itself, such as billing, a change to this policy, or a security matter. We do not send marketing email, we do not sell or rent your information, and we do not use it for advertising or to train machine learning models.

We share information only with the service providers that help us run the App, each only for the service it provides:

Shopify
The platform the App runs on. Shopify bills your plan and holds your uploaded images in your Shopify Files.
Chaport
Live chat inside the App admin, never on your storefront. It receives your store name, myshopify domain, and plan, and whatever you write in the chat.
Contabo
Hosts the server the App runs on, in the United States.
Cloudflare
Carries requests to timer.trestack.app and trestack.app and sees the IP address of each, as any network provider does. It also runs the contact form: its Turnstile check blocks spam, and a small function on Cloudflare emails your message to our inbox through Cloudflare Email Routing without storing it.
  • We may also share information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request, or to otherwise protect our rights, and we will tell you unless the law forbids it
  • If TreStack or the App is sold or merged, your information moves with it under this policy

If you are a resident of the European Economic Area, the United Kingdom, or a US state with a privacy law such as California or Virginia, you have the right to access the personal information we hold about you, to ask that it be corrected, updated, or deleted, to receive it in a portable form, and to object to processing we base on our legitimate interests. We honour these rights for every merchant. To exercise them, write to us at the address below. You can also complain to your data protection authority.

Your information is processed in the United States, outside Europe. Where it leaves Europe, the standard contractual clauses or another valid mechanism apply.

Retention: daily counts are kept for 400 days and a deleted timer is purged after 30 days. When you uninstall, your access token is deleted at once, and Shopify's shop redaction request, sent 48 hours later, deletes all of your store's data from the App. Customer data requests and customer redaction requests from Shopify have nothing to return or delete, because the App holds no customer data.

We protect your information with encrypted access tokens, HTTPS on every connection, key based server access behind a firewall, and nightly backups kept for 14 days. If a breach affects your store's data, we will tell you without undue delay.

The App is a business tool and is not directed at children under 16.

We may update this privacy policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. The date above marks the current version, and every change is noted in the changelog before it takes effect.

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, contact us by email or by mail using the details below.

Entity
TreStack. Registered name to be confirmed.
Postal address
40 Nguyen Huu Tho, Hoa Cuong, Da Nang, Vietnam
Privacy requests
[email protected]
Support
[email protected], or the live chat inside the App admin

Questions about this document go to [email protected] and are answered by the people who wrote the app.