Privacy Policy
Airtight: Terms Checkbox — Last updated: September 26, 2026
Airtight: Terms Checkbox is a Shopify app that adds a single checkbox to a merchant's cart and product pages, which a shopper must tick before checking out to confirm they agree to the merchant's terms and conditions. This policy explains what data this app touches and how it handles it.
What this app touches
When a shopper ticks the checkbox, the app writes a single acceptance record directly onto that order: the exact wording of the terms the shopper agreed to, and the time they agreed to it. This is written as a cart attribute and, where relevant, a line-item property — both are standard parts of a Shopify order, stored the same way as any other order detail such as a gift note or delivery instruction.
That acceptance record is the only thing this app writes or reads on an order. It does not collect, store, or process any personal information itself — no names, email addresses, physical addresses, or payment details ever pass through this app. Everything about who placed the order remains entirely within the merchant's own Shopify store and its existing checkout and order-management systems.
What this app stores
The store's connection to Shopify. The access token and refresh token Shopify issues to the store when the app is installed, with the permissions they were granted and when they expire. They are issued to the store rather than to a person.
An install record for Marquee Apps. The shop's
.myshopify.com domain, when the app was installed and
uninstalled, whether it is a development or Shopify review store, and the
name and number of the store's current subscription to this app. It is kept
in the same database and used only for the notices described below. It is
about the store, not a person.
Notices to Marquee Apps, sent through Resend
When a store installs the app, subscribes, changes plan, cancels (or declines a charge, or lets one expire), or uninstalls, the app sends Marquee Apps a short email about it. These emails are sent through Resend (resend.com), our email provider, which delivers them on our behalf.
Each one contains the shop's .myshopify.com domain, the name,
price and dates of the plan, the subscription number, and whether it is a
test. It contains nothing about any person — no merchant or staff name,
email address, or login — and nothing about shoppers. The emails go only to
Marquee Apps; the store receives nothing from them.
How stored data is protected
Encrypted at rest. In the app's database, the store's
access token and refresh token are encrypted with AES-256-GCM before they
are written, and decrypted only in memory when the app needs them. What is
not encrypted: the shop's .myshopify.com domain, which the
record is filed under; the permissions the token was granted; and when the
token expires. The encryption key is kept outside the database, on the same
server, readable only by the account the app runs as.
Logs. The server records which of the app's pages and notifications were requested — the address only, nothing after it — and which store they were for, and the web server records each visit's IP address and browser. The app never writes a token or anything a shopper entered to a log. All logs are deleted after about two weeks.
What this app does not do
- It does not use cookies, analytics, or tracking scripts of its own.
- It does not sell or rent any data, and shares none with third parties apart from Resend, which delivers the notices described above.
- It does not maintain a separate database of shoppers or orders — the acceptance record lives only inside the merchant's own Shopify order data, not in any system this app operates.
- It does not access customer data beyond what is required to display the checkbox and write the acceptance record described above.
Data retention
Because the acceptance record is stored as part of the order itself, it is retained for exactly as long as the merchant's Shopify store retains that order — governed by the merchant's own data retention practices and Shopify's own policies, not by this app. This app does not independently retain a copy of any order or acceptance record anywhere else.
The store's connection to Shopify is deleted when the app is uninstalled. The install record is kept while the app is installed, marked with the date when it is uninstalled, and deleted when Shopify sends the request to erase the shop's data, 48 hours after the app is uninstalled. That request removes the store's connection and its install record.
The merchant's own privacy policy
This page covers only what this app itself does. The store you're purchasing from has its own privacy policy covering how it collects and uses your personal information more broadly — that policy, not this one, governs your order as a whole.
Changes to this policy
If this policy changes, the updated version will be posted at this same address with a revised "Last updated" date above.
Contact
Questions about this policy or this app can be sent to Support@MarqueeApps.com.