Privacy Policy

Effective: 2026-05-24 · TabsBy (“we”, “us”, “our”)

Summary

TabsBy is a display-only Shopify app. We read your product descriptions and product metafields so we can render them as tabs on your storefront. We do not collect, store, or share buyer data. We do not access orders, customers, or checkout.

What we collect

• Shop identity — your .myshopify.com domain and an OAuth access token, so the app can call Shopify on your behalf.
• App configuration — the tab templates, per-product overrides, default content, and styling preferences you create inside the app. Stored in our database.
• Product data (read-only) — product descriptions and product metafields, fetched on demand from Shopify when a storefront page is rendered. We do not persist product data.

What we do not collect

• Buyer or customer personal data.
• Orders, carts, checkouts, or payment data.
• IP addresses or tracking pixels on buyer-facing pages.

Scopes we request

read_products — required to render the product description and metafields as tabs. Nothing else.

Third parties

• Shopify — hosts the OAuth flow and serves the Admin API we read from. Subject to Shopify's privacy terms.
• Vercel — application hosting.
• Neon — Postgres database for tab configuration.
• Sentry — server-side error tracking (no buyer data ever reaches Sentry).

Retention & deletion

We retain your app configuration as long as the app is installed. When you uninstall, our app/uninstalled webhook deletes your shop record and all related configuration within minutes. The shop/redact webhook (sent ~48 hours after uninstall by Shopify) is also honored and triggers the same deletion as a safety net. We have no buyer data to redact, so the customers/data_request and customers/redact webhooks return 200 with no data.

Security & incident response

Data is encrypted in transit (TLS 1.2+) and at rest by our database provider. Webhooks are HMAC-verified. Production access is limited to the app operator. If we become aware of a security incident affecting your data, we notify affected merchants at their store-owner email within 72 hours — what happened, what was involved, and what we are doing about it — and report it to Shopify through Partner support.

Your rights

Email danny@8thorigin.com from the store-owner email on file to request export or deletion outside the uninstall flow. We respond within 5 business days.

Changes

We may update this policy. Material changes will be announced in-app before they take effect.

Contact

danny@8thorigin.com