Privacy Policy — InSeason

InSeason (“the App”) is a Shopify application provided by Coastal Division (“we”, “us”). This policy explains what the App stores, why, and how it is handled. Questions go to hello@getinseason.app.

The short version. The App stores the seasons you set up and, for every product a season changes, the value it had before the change, so the close can put it back. It collects no information about your shoppers at all — no names, emails, addresses, IP addresses, orders or payment details — and it adds nothing to your storefront: no theme code, no scripts, no cookies.

What the App does

InSeason schedules changes to a Shopify store around a season: a window of dates the merchant chooses, run once or every year. When a season opens, the App can publish or unpublish products on the Online Store, change variant prices (moving the old price to the compare-at price), and create or re-date a discount code. When the season closes, it restores every product it changed to the values it saved before the change.

Information we collect

About the store

Store domain (for example example.myshopify.com), the store’s timezone and currency, and the ID of its Online Store sales channel.
The access token Shopify issues at installation, with its refresh token, expiry and the permissions granted. It is what lets the App make the changes you schedule. The App uses an offline, store-level token; it does not store the names or email addresses of your staff.
Your subscription state (plan name and status, and when it last changed), so the App knows whether a season may open.
Install and uninstall dates.

About your seasons

Season settings: each season’s name, dates, times, timezone and whether it repeats, and the changes it makes — the product and collection IDs you chose, the price change, and the discount code’s text, value, scope and Shopify ID.
Saved values: before a season changes a product, the App records the product and variant IDs and the value about to change — the price, the compare-at price, or whether the product was published. These are read when the season closes to put the store back. They are never overwritten.
Activity records: when each season opened and closed, what each step did, and any error Shopify returned. They power the dashboard’s activity feed and the one-click fix when something fails.

About shoppers

None. The App has no storefront component. It adds no theme code, app blocks, scripts, cookies, pixels or analytics to your store, and it never sees a shopper’s visit. It does not request access to orders, checkouts or customers.

About visitors to this website

getinseason.app is a static site. It has no forms, sets no cookies, runs no analytics and loads nothing from third parties. Its host keeps standard server request logs.

Permissions the App requests

read_products — list products and collections for you to choose from, and read the values it saves before a change.
write_products — change variant prices and compare-at prices, and put them back.
write_publications — publish and unpublish products on the Online Store, and put them back.
write_discounts — create a season’s discount code, or change the dates on one you chose.

Nothing else. The App never requests theme access and never edits titles, descriptions, tags, images or inventory.

Information shared with third parties

We do not sell data, and we do not share it with advertisers or data brokers. Data is handled only by the providers listed under “Subprocessors” below, acting on our instructions.

How data is stored and secured

The App and its PostgreSQL database are hosted by Railway. All traffic between Shopify, your browser and the App is encrypted with TLS. Every webhook Shopify sends is HMAC-verified before it is trusted, and every request from the Shopify admin carries a session token the App verifies. Access tokens are stored in the App’s database and are never sent to a browser.

Data retention and deletion

When you uninstall the App, your session and access token are deleted immediately, every scheduled season is cancelled, and yearly seasons stop repeating.
48 hours after uninstall, Shopify sends the shop/redact webhook and the App deletes everything else it holds for the store: seasons, saved values, activity records and the store record. Until then the data is kept so a reinstall can pick up where you left off.
A season running when you uninstall cannot be put back: Shopify removes the App’s access at uninstall. End running seasons first, or restore those products by hand.
We implement Shopify’s mandatory privacy webhooks: customers/data_request and customers/redact (both verified no-ops, because the App stores no customer data to return or erase), and shop/redact (above).

You may request deletion of your store’s data at any time by emailing hello@getinseason.app.

Your rights

Depending on where you live, including under the GDPR and CCPA, you may have the right to access, correct, export or delete personal data we hold, and to object to its processing. The App holds no shopper personal data and no staff names or emails; the store domain and access token are the closest it comes. Requests to the address above are answered within 30 days.

Data processing terms for merchants

For merchants who install the App, this section forms our data processing agreement. Coastal Division acts as a processor (or service provider) of the limited data described above, and the merchant is the controller. We process that data only to provide the App’s features, on the merchant’s behalf and configuration, and for no other purpose. We do not sell personal data. We apply the security measures described above, delete stored data on receipt of Shopify’s redaction webhooks, and will assist merchants with data subject requests as described under “Your rights.”

Subprocessors

Our subprocessors are Shopify (the platform the App runs on and bills through) and Railway (application hosting and database). We will update this policy before adding others.

A note on season dates

InSeason schedules changes to a store; it is not a source of legal hunting or fishing season dates. Seasons vary by species, zone and weapon and change every year, and merchants are responsible for the dates they enter. Where the App offers example seasons, they are placeholders and are labelled unverified.

Children’s privacy

The App is not directed at children and does not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy as the App evolves. Material changes will be reflected in the “Last updated” date above and, where required, communicated to merchants directly.