Faqwright FAQ Accordion — Privacy Policy

Last updated: 2026-10-10. Faqwright FAQ Accordion is provided by Graham Tizzard, trading as SteadyKeel, England, who is the data controller for the data described here.

What we collect

When you install Faqwright FAQ Accordion, we collect and store:

• Your shop's .myshopify.com domain.
• Offline access and refresh tokens plus expiry metadata issued by Shopify, used only to read your product/collection list (for the assignment picker) and to check your Shopify-managed subscription status. Stored encrypted.
• The FAQ groups you create and which products or collections you assign them to.

We do not retain customer data in our application database or use visitor tracking:

• Customer names, emails, addresses and order history. The app never requests customer or order scopes.
• Payment card details — all billing runs through Shopify's own managed pricing; we never see your card and never handle a charge ourselves.
• Analytics cookies or any storefront visitor tracking.
• The name or email of the staff account that installed the app.

Storefront behaviour

The storefront block calls our app through Shopify's App Proxy to fetch the content assigned to the product being viewed. As with any web request, our server necessarily sees the visitor's IP address, and Shopify's App Proxy also attaches the logged-in customer's ID, if there is one. We transiently process signed query parameters to verify the request. We do not persist these identifiers in our application database. Worker observability is disabled, so no request logs are kept.

Retention

On uninstall, we immediately clear access and refresh tokens and their expiry metadata. Hourly cleanup deletes shop rows marked uninstalled more than 48 hours ago. We delete your shop's data (access token, FAQ groups, assignments) within 72 hours, or immediately if Shopify sends us a shop/redact webhook, whichever comes first.

Data requests

Shopify sends us customers/data_request and customers/redact webhooks on behalf of your customers. We transiently process authenticated webhook payloads without retaining them. Because our application database holds no customer data, there is nothing to return or erase for those requests beyond confirming that fact.

Where data is stored

Shop and FAQ groups data is stored in a Cloudflare D1 database operated by SteadyKeel, using Cloudflare, Inc. as our hosting processor. Data may be processed outside the UK under Cloudflare's standard contractual safeguards. Access tokens are encrypted at rest. Cloudflare D1 Time Travel retains point-in-time restore history for up to 30 days.

Why we use it

We use this data only to provide the app to you (performance of our contract with you). We never sell it or use it for advertising.

Contact

Questions or requests about your data: steadykeeluk@gmail.com (also our App Store support and emergency developer contact).

Changes

We'll update this policy and the "last updated" date above if what we collect or how we use it changes, and note the change in the app's changelog.