Privacy Policy
Effective date: October 18, 2026
Last updated: November 11, 2026
This Privacy Policy explains how Sukhyun Kim ("we", "us", or "our") handles information in connection with Osewa (the "App"), an app for Shopify stores.
1. About the App and our role
The App is installed by businesses that run an online store on Shopify ("Merchants"). Shoppers of those stores ("Customers") can adopt a pet on the store's pages and feed it once a day. When the number of feedings set by the Merchant is reached, the pet brings the Customer a coupon as a thank-you. If the Merchant uses a loyalty app in their store and turns on points in the App, Customers can receive that store's points instead of, or as well as, coupons. If the Merchant chooses store credit, Customers receive a balance they can spend in that store (Shopify store credit).
Our role depends on the type of information:
- Merchant information: We decide how this information is used to provide the App, and act as the controller.
- Customer information: We process this information only on behalf of the Merchant and only to provide the App's features. We act as a processor (or service provider). The Merchant decides how Customer information is used, so please also read the privacy policy of the store you shop at.
2. Information we handle
2.1 Merchant information we receive through Shopify
| Information | Details |
|---|---|
| Store identifier | The store's domain (for example, example.myshopify.com) |
| Access token | The credential that lets the App use Shopify's APIs |
| Granted permissions | The API permissions granted to the App |
| Store time zone | Used to decide "today", and whether the pet's room shows day or night, in the store's local time |
| App subscription status | For stores billed through Shopify (Shopify App Pricing): the plan, the billing period, usage and charges for the current billing period, and the store's Shopify ID |
| Store owner's email address | The address the store registered with Shopify. We read it only when a Customer data access request arrives, so that we can tell you about the request by email. We don't store it in our database (it remains in our logs, section 2.5) |
2.2 Information Merchants give us directly
- App settings (whether the App is on and the dates it was turned off and on, the number of feedings needed for a coupon, the coupon's type, value, minimum purchase, and validity period, whether the coupon grows with each thank-you gift and by how much, the extra rewards given on top of the thank-you gift (streak bonuses, monthly bonuses, and milestone rewards) with how each is counted, its number of feedings or days, type, and value, whether Customers pick one of two rewards and what the second reward is, the monthly coupon limit per Customer, which kinds of other discounts the coupons can be combined with, whether a coupon's contents are hidden from Customers until it arrives, which products each reward works on and, for a free product given only with another purchase, which items must be bought with it (all products, or collections or products chosen by the Merchant; for chosen ones, their IDs, names, and URL handles, which we re-read from Shopify when the App's admin page is opened), whether points are used and what they are called, and whether daily points are on and how many). We record when the App was off so that those days don't break a Customer's streak
- Contact details (such as name and email address) and the content of any inquiry you send us
2.3 Customer information
| Information | Source | Details |
|---|---|---|
| Customer ID | Shopify (an identifier that Shopify signs and sends for Customers who are logged in to the store) | A number that identifies the Customer within the store |
| Game records | Customer actions | Pet type and color, pet name (optionally entered by the Customer), the number of feedings and thank-you coupons for the pet, when the pet was adopted and graduated, the dates the pet was fed, the current and best streak, the date the current streak started, and total counts. If the Merchant changes the settings partway, the coupon terms for the round the Customer is in the middle of (the terms before the change). For stores billed through Shopify, to calculate charges, the date and time the Customer first fed their pet in each Shopify billing period |
| Coupon records | Issued by the App | Coupon code, its kind (thank-you, streak bonus, monthly bonus, or milestone reward) and which pet and thank-you, streak, month, or feeding it was issued for, which of the Customer's thank-you gifts it is, the coupon's contents (discount type, value, minimum purchase, the products it works on, and any items that must be bought with it), which reward the Customer picked if they were offered two, the streak at the time of issue, issue date and time, the date and time it becomes usable, expiry date, and whether it has been used |
| Reward choice records | Recorded by the App (only for stores that let Customers pick one of two rewards) | The kind (thank-you, streak bonus, monthly bonus, or milestone reward) and which period it was for, the two rewards offered when it arrived (type, value, minimum purchase, and validity period), when it arrived, the streak at that time, and which reward the Customer picked and when. The picked reward then becomes a coupon, point, or store credit record |
| Point records | Recorded by the App (only for stores that use points) | The kind (daily points, thank-you, streak bonus, monthly bonus, or milestone reward) and which feeding, pet and thank-you, streak, or month it was for, the number of points, when they were earned, and whether and when they were handed to the store's loyalty app. We do not keep point balances; the store's loyalty app does |
| Store credit records | Recorded by the App (only for stores that use store credit) | The kind (thank-you, streak bonus, monthly bonus, or milestone reward) and which period it was for, the amount and currency, the expiry date, when it was earned, whether and when it was added in Shopify, and Shopify's transaction ID. We do not keep balances; Shopify does |
| Data access requests | Shopify (when the Customer asks the store for their data) | Shopify's request number and when the request arrived, kept until the Merchant marks it as sent. We keep it only for Customers we hold records about |
We do not collect Customers' names, email addresses, postal addresses, phone numbers, order history, or payment information.
2.4 Information stored on Customers' devices
To display the pet button shown on every page quickly and to reduce network requests, the App can store the following in the browser's local storage (localStorage): the Customer ID, the pet's type, color, and growth stage, whether the pet still needs to be fed that day, whether the pet is sad (after several days without food), whether the store has turned the App off, and when this was last checked. It can also store whether the tip on tucking the pet button away has been shown, so that the tip is not shown again.
The App stores this information only when storing preferences is allowed. In regions where the Merchant's privacy settings require consent (for example, the European Economic Area and the United Kingdom), this means only after the Customer allows preferences in the store's cookie banner. We check this with Shopify's Customer Privacy API. When storing preferences is not allowed, the App does not store this information and deletes any it stored before.
The App also stores whether the Customer has tucked the pet button into the edge of the screen, because the Customer asked for the button to stay that way on that device. When a Customer chooses to stay with their pet after a thank-you, the App stores that choice in the browser's session storage (sessionStorage) until the tab is closed, so it does not ask again. It stores only the number of pets the Customer has said goodbye to and the number of feedings.
The App does not use cookies. We never use this stored information for advertising or for tracking Customers across stores. Customers can delete it at any time through their browser settings.
2.5 Information recorded automatically (logs)
To confirm that the App is working and to respond to errors and misuse, our servers automatically record access logs (such as date and time, the requested URL, IP address, and browser type) and error logs. The requested URL may include the Customer ID added by Shopify.
We also count how many times the pet button shown on every page is opened, per store and per day. We do not record who opened it.
3. How we use information
We use information only for the following purposes:
- Providing the App's features (showing the pet, recording feedings, calculating growth and streaks, issuing and displaying coupons, handing points to the store's loyalty app, and adding store credit)
- Showing Merchants how the App is used (such as the number of Customers playing, the number of coupons issued, and the share of Customers who keep playing)
- Maintaining and improving the App and investigating problems
- Preventing misuse and keeping the App secure
- Responding to Merchant inquiries and sending important notices about the App
- Complying with Shopify's terms and applicable laws, including responding to data access and deletion requests
We do not use information for advertising or for profiling Customers, and we do not sell, rent, or "share" personal information (as those terms are defined under applicable U.S. state privacy laws).
4. When we disclose information
We do not disclose information to third parties except in the following cases:
- To Merchants: We may provide Customer information to the Merchant of the store the Customer used (for example, to respond to the Customer's access request).
- Coupons through Shopify: When a Customer earns a coupon, we use Shopify's API to create a discount code in the Merchant's store that only that Customer can use once.
- Points through Shopify Flow: When the Merchant has turned on points, each time a Customer earns points we pass the Customer ID, the number of points, and what they were for to Shopify Flow (an app by Shopify). For some stores, we do this by writing a tag and the number of points (a metafield) to that Customer's record in Shopify. Adding the points to the Customer and keeping the balance is done by the loyalty app the Merchant uses in their store, and how that app handles the information is governed by its provider and the Merchant.
- Store credit through Shopify: When the Merchant has chosen store credit, each time a Customer earns it we pass the Customer ID, the amount, the currency, and the expiry date to Shopify's API, which adds it to that Customer's store credit. Shopify keeps the balance and applies it at checkout.
- Usage reports to Shopify: For stores billed through Shopify, to calculate charges, we tell Shopify how many Customers fed their pet in the billing period (one report of "1 Customer" per Customer per billing period). We send only the store's ID, the time, and the count, never Customer IDs or anything else that identifies a Customer.
- Business transfers: If the App's business is transferred through a merger, acquisition, or similar transaction, information may be transferred to the successor.
- As permitted by law: When required by law, or when necessary to protect a person's life, body, or property.
5. Service providers and where data is stored
We use the following service providers to operate the App.
Their servers are in the United States, and information is stored and processed in the United States.
| Provider | Purpose | Main storage location |
|---|---|---|
| Google LLC (Google Cloud) | App servers (Cloud Run), logs (Cloud Logging), error reports (Error Reporting), and credential storage (Secret Manager) | United States (us-east1 region) |
| Neon, LLC (a Databricks company; a database service running on Amazon Web Services) | Storing settings, game records, and coupon records | United States (AWS us-east-2 region) |
| Shopify | The platform the App runs on. Stores, Customer IDs, and discount codes (and, for stores that use points, the points passed to Shopify Flow and the tag and number of points written to Customer records; for stores that use store credit, the store credit added) are held in Shopify's systems | As determined by Shopify |
| Anthropic PBC (Claude) | Assisting with developing and operating the App (an AI tool). We use it, for example, to investigate defects and to draft replies to inquiries, which can involve Merchant information. We do not give it Customer information (section 7) | United States |
International transfers: We are based in Japan and do not have an establishment in the European Union or the United Kingdom. The European Commission and the United Kingdom recognize Japan as providing an adequate level of protection for personal data (Commission Implementing Decision (EU) 2019/419). Information is stored and processed in the United States by the service providers above and may be accessed from Japan. When personal data of individuals in the European Economic Area, the United Kingdom, or Switzerland is transferred to these providers in the United States, it is protected as follows:
- Google LLC and Databricks, Inc. (the parent company of Neon, LLC, which its certification also covers) are certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. Their data processing terms also provide for the European Commission's Standard Contractual Clauses.
- Anthropic PBC uses the European Commission's Standard Contractual Clauses. We do not give it Customer information.
- Shopify handles transfers within its own systems under its own terms and privacy policy.
6. How long we keep information
| Information | Retention |
|---|---|
| Customer game, coupon, reward choice, point, and store credit records | While the Merchant uses the App. However, when one year has passed since a Customer last played (the later of the day they adopted a pet and the day they last fed it), we automatically delete that Customer's records. Records kept to calculate charges (when the Customer first fed their pet in each billing period) are automatically deleted for billing periods more than one year old. When we receive a Customer data deletion request from Shopify (customers/redact), we delete that Customer's records. The tag written to a Customer's record is removed by the Merchant's Shopify Flow workflow that hands over the points, and the number of points (metafield) is overwritten the next time points are handed over (it is part of the Customer's record in Shopify, which the Merchant manages). |
| Customer data access requests | Until the Merchant marks the request as sent in the App's admin page. Deleted together with that Customer's records |
| Store settings and all records for that store | Deleted when we receive Shopify's store data deletion request (shop/redact), which arrives 48 hours after the App is uninstalled |
| Access token | Deleted when the App is uninstalled |
| Logs | 30 days |
| Inquiry records | 1 year after the inquiry is resolved |
| Information stored on Customers' devices | Remains on the device until deleted through the browser settings. The App deletes the information described in section 2.4 that requires consent when storing preferences is not allowed |
Deleted information may remain in the database's recovery history, kept in case of failures, for up to 7 days. After that, it can no longer be restored.
7. Security
- Encryption in transit: Communication with the App is encrypted with TLS.
- Encryption at rest: Information stored in the database is encrypted at rest (AES-256).
- Data minimization: We do not collect Customers' names, email addresses, postal addresses, or phone numbers. The only Shopify permissions the App requests are for receiving requests from store pages (App Proxy) and for creating discount codes. Only when a Merchant limits the coupons to certain collections or products do we ask, at that moment, for permission to read products and collections. Only when a Merchant turns on points do we ask, at that moment, for permission to read customers (for some stores, to write a tag and the number of points to customer records). Only when a Merchant chooses store credit do we ask, at that moment, for permission to add store credit and to read the transactions we add. Even then, we do not read Customers' names, email addresses, postal addresses, or phone numbers.
- Protection against impersonation: We only use Customer IDs whose Shopify signature we have verified, so no one can operate another person's records by sending someone else's Customer ID.
- Separate environments: Our production database is separate from our development and test databases.
- Credential management: API credentials and database connection details are kept in a dedicated secret management service, not in source code.
- Limited access: Only the operator personally can access the production environment.
- No Customer information for AI tools: We use an AI tool to develop and operate the App (section 5), but we do not give it Customer IDs or any other Customer information. When investigating logs, we mask such information first.
- Data requests: We accept the three requests defined by Shopify (Customer data access, Customer data deletion, and store data deletion). Deletion requests are processed automatically. For access requests, we show a notice in the App's admin page, where the Merchant can view and download the information we hold about that Customer, and we also tell the Merchant by email.
8. Your rights and requests
Customers
We handle Customer information on behalf of each store's Merchant.
To access, correct, delete, or restrict the use of your information, please first contact the store you shopped at.
We respond to requests that the store sends to us through Shopify. If you contact us directly, we will work with that store to respond.
Merchants
Please contact us using the details below. After verifying your identity, we will respond in accordance with applicable law. We do not charge a fee for these requests.
Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to restrict or object to its processing, and to lodge a complaint with a data protection authority.
9. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in law or in the App's features.
Changes take effect when the updated policy is posted on this page. We will announce important changes in the App's admin page or on this page.
10. Contact
Sukhyun Kim
Address: Provided without delay upon request
Email: osewa.support@gmail.com