Privacy Policy
Boxsmith: Mix & Match Bundles · Last updated August 30, 2026
Boxsmith (“the app”) is a Shopify app that lets merchants offer mix-and-match product bundles, gift boxes and hampers.
Data we process
- Merchant store data: shop domain, product, collection and theme configuration needed to create and display bundles, and an offline API token to act on the merchant’s behalf. Stored for the lifetime of the installation.
- Customer and order data: none. The app does not request access to orders or customers, and no customer names, emails, addresses, order contents, or payment details are ever read or stored.
- Storefront visitors: the bundle picker and deal cards run in the shopper’s browser. They report anonymous counts to the app: that a picker was viewed or a deal opened, that a bundle or deal was added to the cart, and for a deal, how many of its items the shopper swapped for another product. These are stored only as daily totals per store. No cookies, no shopper-identifying data (no IP addresses, browser details, or which products were chosen), no tracking across pages or sites.
Data sharing and selling
We do not sell, rent, or share any data with third parties. Data is hosted on Fly.io, encrypted in transit and at rest.
Retention and deletion
Uninstalling the app deletes its access tokens. On Shopify’s shop redaction notice (48 hours after uninstall) all stored data for the shop is deleted. Customer data requests are acknowledged automatically; the app holds no customer personal data to return or erase.