Specsmith
Privacy policy
Last updated 10 October 2026.
This policy covers Specsmith, a Shopify app ("the app"), built and supported by Michael Costa, trading as White Hat Harbor ("we"). The app runs on Cloudflare Workers under our account and stores data for the shops that install it.
What the app processes
| Data | Source | Why | Stored? |
|---|---|---|---|
| Product data: titles, descriptions, images, variants and their options, SKUs, barcodes, weights and prices, vendor, type, tags, and the metafields you pick | Your shop | To draw each product's sheet | Not kept by the app, apart from the product's ID and title for products with a sheet. The PDF is drawn in your browser. |
| Metafield definitions: names, keys and types | Your shop | To list the fields you can pick on the Fields screen | Only the ones you add to your sheet, with your labels |
| Design settings: template, paper size, accent colour, header and footer text, logo link, the field list, and when each screen was saved | Entered by you in the app | To draw your sheets the same way every time | Yes |
| Sheet records: product ID and title, a fingerprint of what the sheet was drawn from, the PDF's file ID in your shop, when it was made, and whether it's out of date | The app, when you publish | To know which products have a sheet and which need updating | Yes |
| Your shop's access token | Shopify, when the app is installed | To call Shopify's API for your shop | Yes, until uninstall |
The app doesn't read orders, and it doesn't read or store anything about your customers or your shoppers: no names, email addresses, phone numbers, addresses or browsing data. The text you put in the header and footer (such as your business contact details) is stored as part of your design and printed on your sheets.
Where data goes
- Hosting: the app runs on Cloudflare Workers. Its database is Cloudflare D1, which encrypts everything it stores at rest (AES-256), and all traffic uses HTTPS.
- Your browser: PDFs are drawn inside the app's page in your Shopify admin. Product images and your logo are loaded by your browser from Shopify's file servers.
- Shopify: the app calls only Shopify's API, and only for your shop. It uploads each PDF to your store's Files and saves the link in an app-owned field on the product. Shoppers download the PDF from Shopify; they never contact the app's server, so the app receives nothing about them.
- Logs: Cloudflare keeps short-lived request logs that we can read. They can include your shop's address, product IDs, counts, and error messages.
- No analytics, tracking, advertising or third-party services in the app. We don't sell or share data.
Retention and deletion
Data is kept while the app is installed. When you uninstall, the app deletes your access token straight away. Your design and sheet records stay for 48 hours, so a quick reinstall keeps your design. Shopify then sends a shop deletion request, and the app deletes everything it holds for your shop: design settings, sheet records and any remaining sessions. Customer data requests and customer deletion requests have nothing to act on, because the app holds no customer data.
The PDFs are files in your shop, not in the app, so they stay in Content → Files after you uninstall; delete them there if you don't want them. After an uninstall the app can no longer change anything in your shop. Shopify stops showing the app's theme block, removes the definition of its app-owned field, and keeps the field's values for a limited time under its own rules.
Your rights
To ask about or delete data related to your shop, email support@whitehatharbor.com or use the support page.
Changes
We'll update this page and its date when the app's data handling changes.