What we access from your store

The app requests these Shopify permissions, and no others:

Products and product metafields (write_products): to store and read which vehicles each product fits, and to render the fitment table on your product pages. Fitment data is written to an app-owned product metafield. We do not read or modify unrelated product fields.
Theme files, read-only (read_themes): so the results page can be rendered in the style of your own theme. We read theme source in order to derive a template we serve from our own servers. We never write to your theme. The derived template and a checksum of the files it came from are stored so the work does not have to be repeated on every page load; they are deleted with the rest of your data.
Store languages, read-only (read_locales): to list the languages your store sells in, so you can translate your storefront text. We read the list of languages only: their names and whether each is published.

We do not request access to orders, customer lists, payment data or financial information.

Separately, the fitment data you import is your business data. We store it so the app can run and so you can edit it, export it and undo changes.

What we collect from your shoppers

My Garage. When a shopper selects a vehicle we save it so results follow them across pages. For a logged-out shopper this stays in their browser and never reaches us. For a logged-in shopper we store the vehicle choices against the customer ID Shopify provides, so their My Garage syncs across devices. We store no name, email, phone or address.
Vehicle searches. We record which vehicle was searched and whether your catalogue had anything that fits, so you can see the search is live and reaching shoppers. These records contain no shopper identity and no IP address. They hold the vehicle selection only.

IP addresses: we do not use them. One reaches our servers as part of any web connection, but we do not read it, store it or log it. Abuse limits are applied per shop and per endpoint rather than per visitor, so there is nothing about you for us to keep.

We do not use cookies for tracking or advertising, and we do not sell data.

Visitors to this website

This website is separate from the app. It runs no analytics script and sets no cookies. There is no advertising network on it, nothing that builds a profile, and no consent banner, because there is nothing to consent to. Cloudflare hosts and serves the pages, so it processes the requests your browser makes in order to deliver them, in the ordinary way any web host does. If you email us, we hold that email in order to reply to it.

Who else touches the data

Who	What for
Shopify	The platform the app runs on, and the party that bills you
Fly.io	Runs the application servers
DigitalOcean	Hosts the PostgreSQL database
Cloudflare	Stores generated assets and the restore points that let you undo a change (copies of your fitment data), and serves this website
Axiom	Application logs, used to diagnose faults

We share data with no one else, and we do not sell it.

How long we keep it

We keep your fitment data and restore points while the app is installed, so you can edit and undo. We keep the newest 25 restore points per store and drop the oldest as new ones are made.
A shopper's My Garage is kept until deleted on request, on a Shopify customer-redaction request, or when the store's data is purged.
On uninstall we delete your session immediately. Shopify then sends a shop-redaction request, at which point all data for your store is deleted: fitment rows, restore points, import records, My Garage entries and search records.
If a subscription lapses rather than being uninstalled, your data stays intact and your export keeps working. After a plan you have paid for ends, the storefront widget stops appearing after 7 days. If you have never paid, it stops appearing until you choose a plan. Nothing in your theme breaks.

Your rights

We honour Shopify's privacy webhooks: customers/data_request, customers/redact and shop/redact. Merchants and shoppers in regions with data-protection laws, including the UK GDPR and CCPA, can request access to or deletion of their data through the store owner, who can trigger these requests through Shopify. You can also write to support@clearfitment.com directly.

Changes

If this policy changes materially, the date at the top changes and the change is described here. We will not quietly broaden what we collect.

11 October 2026. We corrected the list of Shopify permissions. It now includes read_locales.

Contact

support@clearfitment.com