Privacy policy

Last updated: 14 October 2026

What LeakLock processes

When a merchant installs LeakLock, Shopify sends the app order and refund events from that store. LeakLock reads the order's email, phone number, shipping address, browser IP address, discount codes and amounts to detect promo and return abuse.

What LeakLock stores

LeakLock does not store email addresses, phone numbers, addresses or IP addresses in readable form. It stores one-way SHA-256 digests salted per store, plus short hashes used in a checkout filter. It also stores order numbers, amounts, discount codes and the flags it raises. Shopify access tokens are encrypted at rest.

How data is used

Data is used only to detect abuse in the merchant's own store. It is never sold, never shared with other merchants, and never used for advertising. Digests are salted per store, so the same shopper cannot be matched across different stores.

Retention and deletion

When Shopify sends a customer redaction request, LeakLock deletes the digests, orders, stats and flags linked to that customer. When a store uninstalls, access tokens are deleted immediately and all store data is deleted when Shopify sends the shop redaction request, 48 hours after uninstall.

Where data lives

LeakLock runs on Cloudflare Workers and Cloudflare D1.

Contact

Questions or requests: support@thedeki.com