Away Mode privacy policy
This policy explains what the Away Mode Shopify app, made by Oak and Lever, collects, why, who processes it, and how it's deleted. It's written to be read, not skimmed past.
The short version
- We collect what we need to run Away Mode on your store, and nothing for advertising.
- We don't track shoppers. Away Mode sets no cookies of its own and adds no analytics to your storefront.
- We don't sell data.
- When you uninstall, we stop immediately, and we delete your store's data when Shopify asks us to, 48 hours later.
Data we collect from your store
When you install Away Mode, Shopify shares some store details with us through its API. We keep:
- Store details: your shop domain, shop name, contact email and timezone.
- A Shopify access token: needed so Away Mode can turn your away period on and off on schedule while you're not in the app. It's stored in our database.
- Your away period settings and history: dates, mode, message, colour and other options, for current and past periods.
- An event log: when Away Mode turned on or off, and any failures, so we can fix problems and answer support questions.
Data about shoppers
Away Mode only handles shopper data in two cases:
- The “Notify me when you're back” form. If a shopper submits it, we receive their email address and create (or update) a customer in your Shopify store with the tag
away-mode-subscriberand email marketing consent. We store the email address and the resulting Shopify customer ID to avoid duplicates and to count sign-ups in your recap, and delete them 90 days after sign-up. The customer record itself lives in your Shopify store. If the shopper had previously unsubscribed from your emails, we leave their choice as it is. - Orders placed during an away period. Shopify sends us each new order while a period is on. We keep only the order ID and order name (such as #1042), so we can tag the order and count it in your recap, and delete them after a year.
We don't track shoppers, and Away Mode sets no cookies of its own and runs no analytics on your storefront. In “accept orders” mode it adds a “Shipping resumes” note to a cart the shopper has already started, using Shopify's own cart. The storefront script uses the browser's sessionStorage in two narrow cases: it stores a preview flag only when you (the merchant) open the preview link, and it remembers that the current cart has already been tagged so it doesn't tag it twice. sessionStorage is cleared when the browser tab is closed and is never sent to us.
Page views on your store never call our server: Away Mode's on/off state is delivered by Shopify with the page. The only time a shopper's browser contacts us is when they submit the notify form, through Shopify's signed app proxy.
Why we use it
Only to provide the app: scheduling your away periods, showing your notices, tagging orders, collecting sign-ups for you, sending you emails about your away periods, and answering your support requests. We don't sell data, share it for advertising, or use it to build profiles.
Who processes it
We use a small number of service providers to run Away Mode:
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting the app | United States |
| Supabase | Postgres database | United States (US East) |
| Resend | Email to merchants: on/off notices, order alerts, and data-request reports (which can contain a shopper's email address) | United States |
| Shopify | The platform the app runs on, billing, and storing your customers and orders | Per Shopify's policies |
How long we keep it, and deletion
- When you uninstall, we stop all activity on your store immediately.
- 48 hours later, Shopify sends us a
shop/redactrequest and we delete all data we hold for your store. - Shopper requests: we honour Shopify's
customers/redactandcustomers/data_requestwebhooks, which Shopify sends when a shopper asks your store to delete or report their data under privacy laws such as GDPR and CCPA. - Sooner: email support@oakandlever.com from your store's contact email and we'll delete your data earlier.
Customers created by the notify form, and tags or attributes on your orders, live in your Shopify store and stay there after uninstall. You control them in your Shopify admin.
Your choices and rights
Merchants can ask us what data we hold about their store, ask for a correction, or ask for deletion by emailing support. Shoppers should contact the store they bought from or signed up with; the store can act through Shopify, which passes the request to us.
Security
Data is encrypted in transit (TLS) and at rest (our providers' disk encryption). Access is limited to the developer.
Changes to this policy
If we change how Away Mode handles data, we'll update this page and the effective date at the top. For significant changes, we'll also email the contact address of stores that have Away Mode installed.
Contact
Oak and Lever, Illinois, USA. Email support@oakandlever.com. We reply within one business day.