Stallwren Privacy Policy

Effective: November 11, 2026. Publisher: Front Porch Puzzle Press ("we"). This policy covers the Stallwren app for Shopify, including the vendor pages it provides.

Stallwren lets a shop on Shopify ("merchant") sell products made by independent makers ("vendors"): vendors apply, sign in to their own page, add products, see and ship their orders and track their earnings; the merchant approves products, takes a commission and records payouts. The merchant installs Stallwren from the Shopify App Store. We process data on the merchant's behalf and only to run the app.

What Stallwren receives from Shopify

Shop details: the shop's name, myshopify domain, contact email, currency and time zone. The contact email is the Reply-To on emails to vendors and receives new applications and products to review.
Vendor products: for products that belong to a vendor, the title, handle, status, description, type, tags, options, variants, prices, SKUs, stock quantities and photo links.
Orders, without the buyer: for each order, its ID and name, dates, payment status, line items (product, variant, title, SKU, quantity, price, discounts, the product's vendor and how many units are still to ship), refunds and cancellation. Stallwren asks Shopify to leave buyer fields out of these messages and never stores a buyer's name, email, phone, address or customer ID.
The ship-to name and address, read on demand and never stored: only if the merchant turns on "Vendors ship their own orders", when a vendor opens one of their own unfulfilled orders, Stallwren reads that order's shipping name and address from Shopify and shows it on that page so the vendor can post the item. It is not saved, logged or emailed, and it is no longer shown once the vendor's items are shipped. Buyer email and phone are never read.
Locations: names and IDs, to choose where vendor stock is counted.
A Shopify access token for the shop, stored so the app can act for the merchant.

What vendors and the merchant enter

Vendor details: brand name, contact name, email, and optionally phone, location, website, a short story for their maker page, the answer to the shop's application question, how they'd like to be paid and payout details (such as a PayPal email). Vendors are asked not to enter bank account numbers.
Product submissions: titles, descriptions, prices, options, stock and photos. Photos are kept only until the merchant decides (approved photos are copied to the merchant's Shopify store; then ours are deleted).
Commission rules, payouts the merchant records (amount, method, reference, note), adjustments and settings.
The merchant's own email account (optional): mail server, sign-in name and an app password, used only to send this shop's emails. The password is encrypted (AES-256-GCM) and never shown again.

What Stallwren does with it

Runs the vendor pages and sign-in, keeps product submissions for review, creates and updates approved products in the merchant's store, publishes them to the Online Store if the merchant chose that, sets stock that vendors enter, splits orders by vendor and records each vendor's earnings and the merchant's commission, creates fulfillments with the tracking a vendor enters (so Shopify can email the buyer), keeps the payout ledger, produces statements and payout files, shows maker pages on the merchant's storefront, and sends the emails described in the app. Nothing else. No analytics, tracking, advertising or profiling; no selling or sharing of data; no use of data to train AI or machine-learning models.

Vendor sign-in

Vendors sign in with one-time links. We store only a one-way hash of each link and of each session cookie. The cookie is used only to keep a vendor signed in to that shop's vendor page (30 days); there are no tracking or advertising cookies.

Where data is kept, and who processes it

Railway (hosting and the PostgreSQL database), in the United States.
Shopify, which the merchant already uses; Stallwren reads from and writes to the merchant's store through Shopify's Admin API and serves maker pages through Shopify's app proxy.
An email provider: the merchant's own email account if they connect one; otherwise, if enabled by us, an email delivery service. It receives only the email being sent (to a vendor or the merchant).

When a shop installs or uninstalls Stallwren or its plan changes, the publisher may receive a short notice with the shop's myshopify domain, the plan, its price and the time. It contains no other shop, vendor or customer information.

Data is encrypted in transit (HTTPS) and at rest on the hosting provider's storage. Access to production systems is limited to the publisher.

Retention and deletion

While the app is installed, records are kept so balances and statements stay complete. Unused sign-in links and ended sessions are deleted daily; email logs (recipient and outcome only, no message text) after 90 days; photos of submissions nobody decided after 120 days.
When the merchant uninstalls Stallwren, the Shopify access token is deleted at once. Shopify then sends a deletion request 48 hours later, and every record for that shop (vendors, products, orders, earnings, payouts, settings) is permanently deleted when it arrives. Reinstalling within those 48 hours keeps the data.
Customer data and erasure requests from Shopify are answered; because Stallwren holds no buyer data, there is nothing to report or erase.
A vendor who wants their details removed can ask the merchant, or us; money records the merchant must keep for their accounts stay with the merchant's data until the shop's deletion.

Your rights

Depending on where you live (for example under the GDPR or the CCPA/CPRA) you may have rights to access, correct, delete or port personal data. Vendors can download their statements as PDF or CSV at any time. Contact us for anything else.

Children

Stallwren is a business tool and is not directed to children under 13.

Changes and contact

We will post any changes on this page with a new effective date. Questions or requests: hello@frontporchpuzzlepress.com.