Privacy policy

Last updated 8 October 2026.

This policy covers Boothkeeper, a Shopify app ("the app"), built and supported by Michael Costa, trading as White Hat Harbor ("we"). The app runs on a server we operate and stores data for the shops that install it.

What the app processes

Data	Source	Why	Stored?
Order line items: order and line IDs, product and variant IDs, item titles, quantities, prices, discounts, the time of sale and the sales channel (online or POS)	Your shop's paid orders	To credit each consignor their share of their items' sales	Only lines for items assigned to a consignor, as ledger entries. Lines for your own stock are read and not kept.
Refunds: refund and line IDs, quantities, time	Your shop	To take refunded sales back off a consignor's balance	Yes, for consigned items only
Product and variant IDs, titles and tags	Your shop	To know which consignor owns each item	The ID, title and owner of assigned items
Consignor names, keys, shares and optional emails; payout runs, methods and notes; adjustments	Entered by you in the app	To keep balances and produce statements	Yes
Shop settings and currency	You, and your shop	Configuration	Yes
Your shop's access token	Shopify, when the app is installed	To call Shopify's API for your shop	Yes, until uninstall

The app doesn't read or store your customers' names, email addresses, phone numbers or addresses. Consignor details are the ones you type in; the app doesn't email consignors.

Where data goes

Hosting: the app runs on Fly.io. Its database is on a Fly.io volume that is encrypted at rest, and all traffic uses HTTPS.
Shopify: the app calls only Shopify's API, and only for your shop. The one thing it writes there is an app-owned field on each assigned product or variant, holding the consignor's name, so your staff can see it in Shopify admin.
Logs: the server keeps short-lived logs that we can read. They can include your shop's address, order counts, and error messages.
No analytics, tracking, advertising or third-party services in the app. We don't sell or share data.

Retention and deletion

Data is kept while the app is installed, because statements cover any date range. When you uninstall, the app deletes your access token straight away. Shopify then sends a shop deletion request 48 hours later, and the app deletes everything it holds for your shop: consignors, assignments, ledger entries, payout runs and settings. Customer data requests and customer deletion requests have nothing to act on, because the app holds no customer data.

Your rights

To ask about or delete data related to your shop, email support@whitehatharbor.com or use the support page. A consignor who wants their details changed or removed should ask the shop that entered them; the shop can edit them in the app.

Changes

We'll update this page and its date when the app's data handling changes.