Privacy Policy

Address Shield for Shopify · Last updated 2 September 2026

The short version

Address Shield checks shipping addresses inside Shopify's own checkout runtime. Your customers' addresses are never sent to our servers, never stored by us, and never shared with anyone. We hold only what we need to remember your settings and keep the app connected to your store.

What we store

Your store's domain (for example your-shop.myshopify.com).
Your app settings — which checks you have switched on, and any ZIP or postal codes you have chosen to block.
An access token issued by Shopify, so the app can save your settings and keep the checkout rule in place.
Limited account details for the person who installs the app — where Shopify provides them, this may include name, email address and locale. This is merchant account information, not customer information.

What we do not store

No customer shipping addresses. Address checks run inside Shopify's Function runtime, which has no network access. The address is evaluated there and the result is returned to the checkout. It never reaches our servers.
No customer names, emails or phone numbers.
No order data. The app does not request access to your orders.
No payment information of any kind. Billing is handled entirely by Shopify.

Who we share it with

We do not sell or share your data. We use two service providers to run the app:

Shopify — the platform the app runs on.
Railway — hosting and database. Your settings and access token are stored there.

How long we keep it

When you uninstall, your access token and session are deleted immediately.
About 48 hours after uninstalling, Shopify sends us a deletion request and we erase everything else we hold for your store — your settings and any remaining records.
If you ask us to delete your data sooner, we will do so within 30 days.

Your customers' rights

We support Shopify's mandatory data-request and deletion webhooks. Because we hold no customer data, a data request or erasure request for one of your customers will confirm that we hold nothing about them.

Security

All traffic to the app is encrypted with HTTPS. Access tokens are stored in a private database that is not reachable from the public internet.

Changes

If this policy changes in a way that affects what we collect, we will update the date at the top of this page.

Who we are

Address Shield is operated by Kernhill Limited, a company registered in England and Wales, company number 17430477. For data protection purposes, we are the data controller for the information described above.

Contact

Questions, data requests or anything else: support@addressshield.app.