Privacy Policy

Applies to the Shopify app Scaly Advent & Deal Calendar. Last updated: 25 September 2026. The apps Scaly Bundle & Set Builder and Scaly Visual Product Builder have their own policies. Deutsche Fassung.

In short

The app does not read, store or process any personal data of your customers. It sets no cookies and tracks no one. The calendar in your online store never calls our server. It reads its configuration straight from your store.

What the app can access

When you install the app, Shopify grants it these permissions:

read_products: read the products you place behind the doors
write_discounts: create the discount codes that are valid on one specific day
read_themes, write_themes: set up the calendar block in your theme
read_files, write_files: store images for doors and background
read_app_proxy, write_app_proxy: technical connection to your store
write_delivery_customizations: the optional shipping rule that keeps preorder items from counting towards your free shipping threshold. It only hides a shipping rate at checkout; it never sees who is buying.

None of these permissions reaches customer data. The app does not request access to customer accounts, orders or payment data, and Shopify would not grant it.

Where your configuration lives

Your calendar (which product sits behind which door, colours, period, discounts) is stored in your own store, in the shop metafield simple_advent_calendar.configuration. The calendar in your online store reads it from there directly through Liquid, without going through us.

What we store on our own infrastructure

The app runs on Cloudflare Workers. For operation, remote maintenance and support, we keep the following data per store in Cloudflare KV:

your .myshopify.com domain
when the store first used the app and when it last did
a copy of your calendar configuration with the time of its last change, so that we can see what is set up when you contact support, and correct a setting remotely at your request
a log of the last 50 events: time, what happened ("saved", "opened") and where the request came from
the access token Shopify issued to us for your store

The access token is the key to the permissions listed above. It is used exclusively to talk to the Shopify Admin API on behalf of your store and is never passed on to anyone. It is deleted when you uninstall the app (see below). If you do not want remote maintenance, let us know and we will remove the token, and the app keeps working, just without that option.

We do not store product data, prices or images. They are loaded from your store when they are displayed and discarded afterwards.

Support chat

The app's admin pages show a chat bubble in the bottom right corner. When you open it and write to us, our support service (support.scalyapp.de, also on Cloudflare Workers) stores the conversation: your messages and our replies with timestamps, your .myshopify.com domain, your store's name, the app you wrote from, your admin language and an email address (by default the store owner's email from Shopify, or the one you enter in the chat). We use this only to answer you. If we are offline, your message is forwarded to our support mailbox by email, and replies you have not read in the chat are sent to you by email.

Nothing is stored until you send a message. Conversations are deleted 400 days after the last message, when you uninstall the app (see Deletion), or earlier on request.

Your customers

The calendar on your storefront is rendered by a theme app extension. It reads the configuration from the shop metafield through Liquid. It does not contact our servers, sets no cookies and collects no statistics. We therefore hold no data about your customers, not even in aggregated form.

Legal basis

Processing takes place to perform the contract with you as a merchant (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in secure and uninterrupted operation (Art. 6(1)(f) GDPR).

Processors

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: hosting of the app (Workers) and the storage described above (KV). Processing may take place outside the European Union; it is based on the Standard Contractual Clauses of the European Commission.
Apple Distribution International Ltd. (iCloud Mail): our support mailbox, and sending the support chat emails described above

No other party receives data from the app or the support chat.

Deletion

The app answers the webhooks Shopify requires. When you uninstall the app and Shopify sends shop/redact, we delete your store's registry entry including the configuration copy, the event log and the access token. As we hold no customer data, there is nothing to hand over or delete for customers/data_request and customers/redact.

On shop/redact we also delete your support chat conversation, if there is one.

Discount codes the app created in your store remain after uninstalling. They are your discounts. You can delete them in the Shopify admin at any time.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with a data protection supervisory authority.

Controller

Scale Media, owner Hani Hussein
Mozartstraße 1
51427 Bergisch Gladbach
Germany

Contact

Questions about this policy or a request concerning your data: support@scalyapp.de. Further legal information: Impressum.

Also by Scaly

Visual Product BuilderShoppers build a piece out of parts and watch it come together while they choose. Bundle & Set BuilderShoppers pick every part of a set on the product page, and each part stays a real product in the cart.