Privacy Policy

Last updated: October 4, 2026 · Operated by NerdLabs (Joren Winge)

CountKit is a Shopify app for stocktakes and cycle counts: merchants scan their stock, review the differences, and apply them to Shopify's inventory. This policy explains what data the app processes, why, and how it is protected.

No shopper data. CountKit does not request, receive or store any of a store's customers' personal data, and requests no protected customer data access. It requests access to products, inventory and locations only, never to customers or orders.

What we process

• Merchant / store data: the store's myshopify.com domain, an expiring Shopify access token, and the subscription plan tier.
• Store owner's email: the email address on the store owner's Shopify account (as set in Shopify, not the store's public contact email), its admin language, and whether it is a development store — used only to email the store owner: account alerts, a one-time welcome note on upgrading to a paid plan, and a one-time note after uninstalling asking what we could improve.
• Catalog and stock data: products and variants (titles, SKUs, barcodes, image links), inventory quantities, and locations, read from Shopify when a count is started, scanned and applied.
• Counts: each count's name, location, the items in it (title, SKU, barcode and image link), the on-hand quantity Shopify had when the count started, the quantity counted, and the change applied.
• Camera: when you scan with your device's camera, the camera frames are read in your browser only. No images or video are sent to us or stored.

Why we process it

Solely to provide the app's functionality to the merchant: running counts, reviewing differences and applying them to the store's inventory. The store owner's email is used only for the emails described above. We do not use it for advertising, profiling, or sale.

Sharing

• Shopify — the platform APIs the app is built on.
• DigitalOcean — hosts the server and database.
• Mailgun — our email provider; delivers our emails to the store owner (sent from support@nerdlabs.us), using the store owner's email above.

We do not sell data or share it for any other purpose.

Retention and deletion

Counts are kept, as the store's count history, while the app is installed. When the app is uninstalled, sessions and access tokens are removed; roughly 48 hours later Shopify sends a shop/redact request and we delete all data stored for that shop, including the store owner's email. Because we hold no customer personal data, the customers/redact and customers/data_request webhooks have nothing to act on and are acknowledged. Changes already applied to the store's inventory remain in Shopify.

Security

Data is stored on a DigitalOcean server, on an encrypted storage volume, with SSH-key-only administrative access. Backups are kept on the same encrypted volume for 7 days, plus daily whole-server backups. All traffic uses HTTPS. App secrets are held only in the server environment.

Changes

We may update this policy; material changes will be reflected here with a new "last updated" date.

Contact

Questions about this policy or your data: support@nerdlabs.us.