Privacy Policy
Bundles Monk, a Shopify app by Metal Weave Games Inc.
Effective date: 10 August 2026
The short version
Bundles Monk does not collect, store, or process the personal data of your customers. The only records we keep are the ones required to talk to your store: your shop domain and the OAuth access token issued when you installed the app.
What we store
- Shop domain (for example
your-store.myshopify.com) and the OAuth session token Shopify issues at install. These live in our database and exist purely so the app can authenticate its API calls back to your store. - Bundle and Complete Set configuration is not stored by us at all. It is written to metafields on your own products and collections, inside your Shopify store, and it stays there.
- Server logs containing request timestamps, shop domains, and error messages, kept for operational troubleshooting. These contain no customer identifiers.
What we do not store
Customer names, email addresses, phone numbers, shipping or billing addresses, order contents, and payment details are never collected by this app. We do not request the read_customers or read_orders access scopes, so Shopify does not send us that data in the first place. The scopes the app requests are read_discounts, write_discounts, read_products, and write_products.
The discount function
The bundle pricing logic runs as a Shopify Function, executing entirely on Shopify's own infrastructure at checkout. It receives cart line data transiently in order to calculate a discount and returns the result to Shopify. That data is never transmitted to us, and nothing from it is retained anywhere.
GDPR and privacy requests
The app subscribes to Shopify's three mandatory privacy webhooks and responds to each of them:
customers/data_request: we hold no data about your customers, so there is nothing to export.customers/redact: we hold no data about your customers, so there is nothing to erase.shop/redact: we delete the session records for your shop. Uninstalling the app already deletes them immediately; this webhook confirms nothing was left behind.
Sharing and subprocessors
We do not sell, rent, or share your data. The app is hosted on Railway (United States), which stores the shop domain and session tokens described above on our behalf. Beyond Railway and Shopify itself, no third party receives data from this app. There is no analytics, tracking, or advertising code in the app or in the storefront blocks it provides.
Retention
Session records are deleted as soon as the app is uninstalled, and again on shop/redact if any remain. Metafields written to your store belong to you and remain under your control after uninstall, to be kept or removed as you prefer.
Security
All traffic to and from the app is over HTTPS. Incoming webhooks are verified against Shopify's HMAC signature and rejected if the signature does not match. Access tokens are stored server-side and are never exposed to the browser.
Changes
If this policy changes we will update the effective date at the top of this page. Material changes will also be noted in the app listing.
Contact
Metal Weave Games Inc.
andreas@metalweavegames.com