How Leak Radar handles your data

Leak Radar requests the minimum Shopify permissions required to calculate return-related metrics. We process:

• ✓Order data — Order ID, order name/number, order totals, currency, and timestamps.
• ✓Refund data — Refund IDs, refund amounts, reasons and notes, associated order IDs, and refunded line items (product title, variant, quantity, and amount).
• ✓Product metadata — Product titles and IDs used to identify which products are driving return losses.
• ✓Shop settings — Shop currency code, used to display monetary amounts in your local currency.

We use the data described above exclusively to:

• →Calculate return rates, monetary losses, and trends over time for your store.
• →Surface which products and return reasons are costing you the most.
• →Generate prioritised action recommendations to help you reduce return losses.
• →Evaluate whether actions you take result in measurable improvement.

We do not sell, rent, or share your data with third parties for advertising, profiling, or any purpose unrelated to operating Leak Radar.

Analytics data (refund records, action history, product metrics) is stored in a secure PostgreSQL database hosted on Railway. Only authorised team members have access to production systems, solely for the purpose of maintaining the service.

Data is retained for as long as your store has Leak Radar installed. Upon uninstall, Shopify sends us an app/uninstalled webhook and — 48 hours later — a shop/redact webhook. Both events trigger permanent, irreversible deletion of all data associated with your shop.

Shopify is the data controller for your customers' personal data. Leak Radar acts as a data processor on your behalf and only handles order/refund analytics — not personal data directly.

We implement Shopify's three mandatory privacy webhooks:

Leak Radar is an embedded Shopify app. It does not use third-party analytics scripts, advertising cookies, or any cross-site tracking. The only cookies set are those required by Shopify's authentication flow (session tokens).

We use Shopify's official OAuth libraries for authentication and store access tokens securely. Our infrastructure is hosted on Railway and benefits from TLS encryption in transit and encryption at rest.

You are responsible for controlling which staff members in your Shopify organisation can access Leak Radar.

We may update this privacy policy from time to time. Material changes will be communicated via an in-app notice. The "Last updated" date at the top of this page always reflects the most recent revision.

For any questions about this policy, data access requests, or deletion requests, reach out to us at: