What data Persistent Cart accesses, and why

Is this the formal privacy policy?

No — this is a plain-language explainer of how Persistent Cart handles data, written so you can understand it without a lawyer. The formal, legal privacy policy is a separate document, linked from this page and from the app listing, and it governs in any case of conflict. We wrote this version because data handling shouldn't be something merchants have to decode. Everything here describes how the app actually works today; if our practices change, we update both this page and the formal policy.

What data does Persistent Cart access?

Persistent Cart accesses a signed-in customer's cart so it can save and restore it. That means the contents of the cart — the line items, their quantities, and any cart notes or attributes — along with the customer's Shopify identifier, which is needed to know whose cart it is and keep it separate from everyone else's. The app reads the customer's name, email, and ID as provided by Shopify to the storefront for the signed-in shopper, and it adds an order tag so synced orders can be recognized. It does not access payment details, and it does not store anything beyond what's needed to sync the cart.

Why does it need that data?

The only reason Persistent Cart reads a customer's cart is to sync it across the devices and browsers that customer signs in on. When a signed-in shopper changes their cart, the app saves the updated cart; when they open the store on another device, it restores it. The customer identifier is used solely to match the right cart to the right shopper, so one person never sees another's cart. There is no secondary use — the data isn't used for advertising, profiling, or resale. It exists to make the cart follow the shopper, and nothing else.

Are guests or anonymous shoppers tracked?

No. Persistent Cart works only for signed-in, identified customers. If a shopper isn't logged into an account, the app doesn't save or sync their cart at all — they get the standard Shopify session and nothing more. The sync depends on having a customer identity to key the cart to, which guests don't have by definition. This is a deliberate scope: the app touches a shopper's cart only when that shopper has chosen to sign in to the store.

Does the app send emails or collect contacts for marketing?

No. Persistent Cart does not send marketing emails to your shoppers, and it does not build or sell marketing contact lists. It isn't an abandoned-cart email tool — it restores carts directly on the storefront instead of messaging shoppers later. The customer email it reads from Shopify is used only to identify the signed-in shopper for sync; it isn't used to advertise to them, and it isn't shared with advertisers or third parties for marketing. If you want to email shoppers, that's your email platform's job, not this app's.

Where does my store's data live, and who can see it?

Each store's cart data is scoped to that store. Carts are keyed to both the customer and the specific Shopify store domain, so data from one merchant's store is never mixed with, or visible to, another's. Shared workstations are handled the same way — because carts are tied to the signed-in customer, one shopper's cart won't appear for the next person on the same device. The data is used to operate the sync service for your store, and it isn't pooled into a cross-merchant dataset for any other purpose.

How are data requests handled, and how do I make one?

Data requests are routed through Shopify's required data-protection flows. As a Shopify app, Persistent Cart receives Shopify's required data-request webhooks — for data access, customer redaction, and shop redaction. Because the app's data is tied to your store and your customers, the most reliable way to start a request — whether you're a merchant, or a shopper asking a merchant — is through the store on Shopify, which routes it to us through those flows.

You can also email support@persistentcartapp.com and we'll help. For the precise legal commitments, timelines, and how data deletion is carried out, see the formal privacy policy linked from this page; this explainer describes the practical path, not the legal text.