Legal

Privacy policy

Effective August 27, 2026

Still Sleepy (“we,” “us,” or “Still Sleepy Storefront Guard”) provides automated storefront testing for Shopify merchants. This policy explains what we process, why we process it, and how merchants can contact us.

Information we process

We receive the installing shop domain, authenticated app session, granted scopes, and live/unpublished theme metadata. We request onlyread_themes and do not request customer, order, product-write, or theme-write access.

Merchant-requested checks process storefront domains and paths, browser diagnostics, accessibility findings, cart-verification evidence, timing, and desktop/mobile screenshots. A storefront password is held only in the encrypted job payload for that run and is not stored in records or results.

Use and sharing

We use this information only to authenticate merchants, perform requested tests, compare themes, display evidence, secure and troubleshoot the service, and meet legal obligations. We do not sell merchant or buyer data. Service providers are listed on our subprocessor page.

Customer data

Still Sleepy Storefront Guard does not request Shopify customer or order data, enter checkout, or create orders. Customer data-request and redaction webhooks are acknowledged, but there should be no matching customer record to return or delete.

Retention and deletion

Completed and failed scan/comparison records, result documents, and screenshots are automatically deleted after 30 days. Storefront passwords are not retained. Infrastructure logs follow provider-controlled retention windows and are not intentionally retained by us beyond 30 days.

On uninstall and authenticated shop/redact, we delete the shop’s app sessions, scan/comparison records, job metadata, and private artifacts. A merchant can request earlier deletion by contacting us.

Security and international processing

Evidence requires an authenticated Shopify session and matching shop ownership. Storefront targets are limited to Shopify-verified domains, private artifacts are access-controlled, and preview secrets are redacted. Providers may process data outside a merchant’s country under their contractual safeguards. No internet service can guarantee absolute security.

Merchant rights and changes

Merchants may request access, correction, deletion, or information about their data, subject to applicable law. We will update this page and its effective date when this policy materially changes.

Contact