ShipMeter Privacy Policy

Effective October 5, 2026

ShipMeter (“the App”) is a Shopify app made by Mal Squared Labs (“we”, “us”). It shows shoppers a progress bar toward a store’s free-shipping minimum. This policy explains what information the App uses, why, and how it is handled. The App is built to use as little information as possible.

Information we collect from merchants

When you install the App, Shopify gives us the following, which we store so the App can work:

• Your store’s Shopify domain and an access token, with its permissions and expiry. Shopify issues these when you install, and the App uses them to talk to Shopify on your behalf. The token is for the store as a whole. We do not store the names or email addresses of you or your staff.
• Your App settings: free-shipping amount, messages, optional second goal, per-currency amounts and custom CSS. These are saved inside your Shopify store as app data (metafields), not in a separate database.
• Your plan status. If you choose the paid plan, billing goes through Shopify’s billing system. We see only whether a subscription is active. We never see or store payment card details.

The App asks Shopify for no access to your products, orders or customers, and does not read or store them.

Information about your shoppers

The bar runs in your shoppers’ browsers. To work out how close a shopper is to free shipping, it reads the cart total and item count from your own store’s cart, in the browser. That information is not sent to us, and the App does not collect, store or share any personal information about your customers. The App sets no cookies and does no tracking, analytics or advertising.

How we use information

We use the information above only to:

• run the App and show your progress bar with your settings;
• turn paid features on or off to match your plan;
• keep the App secure and fix problems.

We do not sell, rent or share your information with anyone for marketing.

Service providers

The App’s server is hosted by Railway (railway.com), which stores the access token described above. Railway keeps short-lived server logs, which may include your store’s domain and technical request details such as IP addresses. Payments for the paid plan are handled by Shopify. See Shopify’s privacy policy.

Retention and deletion

• When you uninstall the App, we delete your store’s access token from our server.
• App settings saved in your store as app data are removed by Shopify when the App is uninstalled.
• We respond to Shopify’s privacy requests (customer data requests, customer redaction and shop redaction). Because we hold no customer data, customer requests have nothing to return or erase. Shop redaction deletes any remaining data for your store.

Your rights

Depending on where you live, you may have rights to access, correct or delete your personal information, or to object to how it is used. To make a request, contact us at the address below. Shoppers who have questions about their data should contact the store they shopped with.

Security

Data is sent over encrypted connections (HTTPS). Access to the server is limited to us. No method of storage or transmission is completely secure, but we take reasonable steps to protect the small amount of data we hold.

Changes

If we change this policy, we will update the effective date above. Significant changes will be communicated to merchants who have the App installed.

Contact

Questions about this policy or your data: questions.squaredaway@gmail.com