Privacy policy

Effective 2026-07-28. Applies to Handoff Digital Downloads, a Shopify app, and to this website.

What the app processes and why

When a paid Shopify order contains a product with attached files, the app processes:

The buyer's email address. Used to send the download link for that order.
The order id and line items. Used to determine which files were purchased.
The shop domain and an API access token. Used to operate the app for the merchant's store.

That is the complete list. The app never stores buyer names, shipping or billing addresses, phone numbers, or payment details.

What the app never does

It never uses buyer data for marketing, advertising, analytics about buyers, profiling, or automated decision making.
It never sells or rents data to anyone.
It never exposes files publicly. Buyers receive short-lived signed links tied to an unguessable token.

Service providers

The app runs on a small set of infrastructure providers. Each receives only what its function requires.

Cloudflare: application infrastructure and file storage.
A managed PostgreSQL database provider: application data.
Resend: transactional email. The delivery message only.

Retention and deletion

Data is kept only while needed to fulfill and support the order.
When Shopify sends a customer redact request, the buyer's email is removed and their links expire.
When a merchant uninstalls, Shopify sends a shop redact request 48 hours later. All of that shop's records and stored files are deleted.
When Shopify sends a customer data request, we report exactly what we hold for that customer.
All three requests are handled automatically and completed within 30 days.

Security

All connections use TLS. Webhooks are verified with HMAC signatures. Stored data and backups are encrypted at rest. Download links are short-lived and capped per order. Access is limited to the operator. If an incident affects merchant data, affected merchants are notified by email within 72 hours of confirmation.

This website

This website does not use cookies, analytics, or tracking of any kind.

Changes

Material changes to this policy are noted here with a new effective date.

Contact

Halsted Software. support@halstedsoftware.com.