Privacy information

PerkNook helps Shopify merchants create quantity discounts, mix & match offers and gifts. This page describes the data used by the application.

PerkNook is operated by 杰客森.

Postal address: No. 95, Xishan East Road, Mianyang, Sichuan, China.

Data used to provide the service

We store your shop domain, installation and authentication sessions, offer settings, revision history and publication status. Shopify authentication sessions can include the staff account name, email, account ID and locale. Access tokens remain on the server.

We read product variants, prices, availability and inventory costs to configure and preview offers. Public storefront responses contain only the product and offer information needed by shoppers; they do not include product costs or access tokens.

PerkNook does not request customer or order records from Shopify, and does not store shopper names, email addresses, delivery addresses or payment card details in its application database. Cart items and amounts are processed in the shopper's browser and Shopify Functions to determine eligibility. Shopify may send customer information in mandatory privacy notifications; we authenticate those notifications without storing their payloads. We do not use advertising trackers.

When the storefront requests offers through Shopify's app proxy, Shopify can forward the logged-in customer's ID and connection information, such as an IP address. We verify Shopify's request signature and return the shop's offers. We do not use that customer ID to personalize offers, or store these values in our application database or application access logs.

If you contact support, your email address and the information you choose to include are used to respond to your request. Please do not send passwords, access tokens, payment details or customer personal information.

Service providers and security

Shopify provides the commerce, authentication and checkout services. The PerkNook application and its database are hosted on Railway. Data is transmitted over HTTPS, and access to shop records is restricted to authenticated requests for that shop.

We use Resend to deliver requested service emails, including configuration tests. Resend processes the recipient's email address, message content and delivery information to provide this service.

Retention and deletion

Offer records are retained while the app is installed. Uninstallation removes stored authentication sessions and disables the installation; saved offers remain until Shopify sends its shop deletion request. That request deletes shop configuration, offers, revision history, audit records and recorded webhook receipts. Each recorded webhook receipt contains the shop, event ID, event topic and receipt time, not the notification payload.

Application access logs record the request method, path and response status, without query strings, request headers or request bodies. Hosting providers may process connection information and maintain platform logs and backups separately from the application database.

We also keep encrypted database backups on a separate recovery server. These copies are restricted to disaster recovery and verification, and are normally retained for 30 days. If newer backups fail, the last verified copy is kept until a valid replacement is available. Backup copies are not used by the live application. Before a recovery database is returned to service, deletion requests and installation status must be reconciled so that deleted records are not put back into use.

Questions and requests

Contact contact@mistcada.com for privacy questions or an access, correction or deletion request. Include enough information to identify your shop or support conversation; we may need to verify that you are authorized to make the request. For product assistance, see our support page. Do not send passwords or access tokens.