Last updated: May 9, 2026

Privacy Policy

SnapCOD is a Shopify marketing & automation app that provides abandoned cart recovery, marketing pixel tracking, customer segmentation, and a quick order form for merchants. This policy explains what data we collect, how we use it, and your rights regarding that data.

1. Who We Are

SnapCOD (“we”, “our”, “us”) is a Shopify application developed and operated independently. For any privacy-related questions, you can reach us at satiarayici34@gmail.com.

2. Data We Collect

When merchants install SnapCOD, we collect and process the following data:

From Merchants (Store Owners):

  • Shopify store domain and access credentials (OAuth tokens)
  • Store settings and configuration data
  • Notification email addresses

From End Customers (via the quick order form):

  • Full name
  • Phone number
  • Email address (optional)
  • Delivery address (city, district, street address)
  • Order details (product, quantity, total price)

Automatically Collected (for fraud prevention):

  • IP address (stored as a one-way hash — we cannot reverse it to identify the original IP)
  • Browser fingerprint (hashed — used only for fraud detection)
  • Order submission timestamps

3. How We Use Data

  • Order processing: Creating and managing COD orders in Shopify
  • Fraud prevention: Detecting and blocking duplicate or suspicious order submissions
  • Notifications: Sending order confirmation emails to merchants
  • Analytics: Providing merchants with conversion and order statistics (aggregated, not shared with third parties)
  • Advertising tracking: If merchants configure Facebook or TikTok pixels, purchase events are sent to those platforms using hashed customer data

4. Data Sharing

We do not sell, rent, or share personal data with third parties, except:

  • Shopify: Order data is created directly in the merchant's Shopify store via the Shopify API
  • Facebook / Meta: Only if the merchant has configured their Facebook Pixel and Conversions API — purchase events are sent with SHA-256 hashed data
  • TikTok: Only if the merchant has configured TikTok Events API — same conditions as above
  • Legal requirements: If required by law or court order

5. Data Retention

  • Order data is retained as long as the merchant's store is active on SnapCOD
  • Fraud logs are retained for up to 90 days
  • When a merchant uninstalls SnapCOD, their data is retained for 30 days before permanent deletion
  • When a Shopify shop is deleted, all associated data is permanently deleted within 48 hours (per our shop/redact webhook)

6. Your Rights (GDPR / CCPA)

Depending on your location, you may have the following rights:

  • Right to access: Request a copy of personal data we hold about you
  • Right to erasure: Request deletion of your personal data
  • Right to rectification: Request correction of inaccurate data
  • Right to portability: Request your data in a machine-readable format
  • Right to object: Object to processing of your personal data

To exercise these rights, contact us at satiarayici34@gmail.com. We will respond within 30 days.

Merchants can also submit data deletion requests through the Shopify Admin, which will trigger our automated GDPR webhooks.

7. Data Security

  • All data is transmitted over HTTPS (TLS encryption)
  • Sensitive identifiers (IP addresses, browser fingerprints) are stored as one-way SHA-256 hashes
  • Shopify OAuth tokens are stored securely and never exposed to end users
  • Access to the database is restricted to the application server only

8. Cookies

SnapCOD does not use advertising or third-party tracking cookies. The app uses browser sessionStorage (not cookies) to prevent duplicate form view events within a single browser session — this data is never sent to any server and expires when the browser tab is closed.

For fraud prevention, the quick order form also sets a first-party, functional cookie (_cod_did) that mirrors a random device identifier already stored in localStorage. It contains no personal information by itself and is only used, alongside the hashed browser fingerprint described in Section 2, to recognize a returning device and block repeat fraudulent order attempts. It is not used for advertising or cross-site tracking, and expires after 2 years or whenever local browser storage is cleared.

9. Third-Party Services

SnapCOD integrates with the following third-party services at the merchant's discretion:

10. Children's Privacy

SnapCOD is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of SnapCOD after changes constitutes acceptance of the updated policy.

Contact Us

For any privacy questions, data requests, or concerns:
📧 satiarayici34@gmail.com