Store Feed by GrowBoost

Privacy Policy

Last updated: October 9, 2026

This Privacy Policy describes how GrowBoost ("we", "us", or "our") collects, uses, and protects information when you install and use the Store Feed application (the "App") available on the Shopify App Store. Section 9 covers the growboost.pl website itself.

1. Information We Collect

When you install Store Feed, we collect and store the following information:

• Shop domain - your Shopify store's permanent domain (e.g. yourstore.myshopify.com)
• Access token - a Shopify API access token that allows the App to read your store's products, blog articles, discounts, discount rollouts and themes in order to build the feed (see the permissions below)
• App configuration - your widget settings (title, colors, icon set, visibility preferences, etc.)
• Aggregated analytics - anonymous, aggregated counts of widget impressions and clicks per day, broken down by device type (desktop, tablet, mobile). We do not collect or store any personal data about your store visitors.

Store Feed stores only daily counts of widget views and clicks per device type. It does not store shoppers' IP addresses or any personal data. The widget sends its counts through your store's own address (the Shopify app proxy), and Shopify signs every request. To keep anyone from inflating those counts, our server limits how many requests one sender may make per minute; for that purpose it keeps a one-way hash (SHA-256) of the sender's IP address in memory only, discards it after about two minutes, and never writes it to the database. Requests from bots, crawlers and automated browsers are not counted at all.

Permissions the App requests

2. Information We Do Not Collect

We do not collect:

• Personal data of your store's customers (names, emails, addresses, payment information)
• Customer browsing history or individual tracking data
• Your store visitors' IP addresses (see section 1 for the one-way hash used only for rate limiting, held in memory and never stored)
• Any data beyond what is necessary to operate the App

3. How We Use Your Information

We use the collected information exclusively to:

• Display the Store Feed widget on your storefront with your products, blog posts, and promotions
• Store and refresh the feed cache to ensure fast load times
• Show aggregated analytics (impressions, clicks, CTR) in your app dashboard
• Manage your subscription plan (Free or Starter)

We do not sell, rent, share, or otherwise disclose your data to third parties for their own purposes.

4. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Supabase (located in the United States). Access to the database is restricted through Row-Level Security (RLS) and is only accessible by the App's backend. We use industry-standard security practices to protect your data.

Your Shopify access token is stored securely in our database and is used solely to make authorized API calls to your store. We do not log or share access tokens.

5. Data Retention

We retain your data for as long as the App is installed on your store. When you uninstall the App, we mark your store as uninstalled and stop accessing your Shopify store data. Upon receiving a shop/redact webhook from Shopify (typically 48 hours after uninstall), we permanently delete all data associated with your store, including the feed cache, analytics, and configuration.

6. Customer Data Requests

As Store Feed does not collect any personal data about your store's customers, we have no customer data to provide or delete in response to customer data requests. We acknowledge and comply with all Shopify mandatory privacy webhooks:

• customers/data_request - acknowledged; no customer data stored
• customers/redact - acknowledged; no customer data stored
• shop/redact - all shop data is permanently deleted

7. Third-Party Services

Store Feed uses the following third-party services to operate:

• Shopify - e-commerce platform and API provider (Shopify Privacy Policy (opens in a new tab))
• Supabase - database hosting (Supabase Privacy Policy (opens in a new tab))
• Fly.io - application hosting (Fly.io Privacy Policy (opens in a new tab))

8. Cookies and Tracking in the Widget

The Store Feed widget uses sessionStorage (not cookies) to remember whether a visitor has dismissed or minimized the widget. This data is stored locally in the visitor's browser and is not transmitted to our servers. It is automatically cleared when the browser session ends.

9. Cookies on This Website

Strictly necessary. We keep your cookie choice in your browser's local storage so the consent banner does not reappear on every visit. This is stored without consent under GDPR Art. 6(1)(f) - our legitimate interest in the site working correctly.

Analytics - with your consent only. If you allow it, we run Google Analytics 4 through Google Tag Manager to count page views and see which pages are useful. Nothing is set until you choose "Allow analytics".

We use Google Consent Mode v2 with ad_storage, ad_user_data and ad_personalization permanently set to denied. We run no advertising or remarketing cookies. Analytics data is processed by Google Ireland Limited and retained for 14 months.

Embedded video. The home page embeds one film from YouTube through youtube-nocookie.com, Google's privacy-enhanced player. Opening the page loads the player itself from Google's servers, which means your IP address reaches Google. Starting the film lets YouTube set its own cookies and local storage in your browser, under Google's terms rather than ours - we have no access to them and cannot delete them for you. If you have allowed analytics, Google Analytics 4 also records that a video was started, how far it was watched and whether it finished; it records no identity beyond the same visitor statistics described above. You can watch the film directly on YouTube instead, or block third-party cookies in your browser.

You can change your choice at any time: open cookie settings. You can also delete cookies in your browser settings.

You have the right to access, rectify, erase or restrict processing of your data, to withdraw consent at any time, and to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw). Write to support (at) growboost.pl to exercise any of them.

10. Launch Notification List

If you enter your email address in the launch form on growboost.pl, we process that address for one purpose only: to send you a single email announcing that Store Feed is available.

You can withdraw your consent at any time by writing to support (at) growboost.pl. Withdrawal does not affect processing carried out before it. If you withdraw before launch, you will not receive the announcement at all.

11. Accessibility

We want growboost.pl and the Store Feed app to be usable by everyone, including people who browse with a screen reader, with the keyboard only, or with the page magnified.

The standard we work to

We build against EN 301 549, the European standard for accessibility of ICT products and services, which for digital content adopts WCAG 2.1 level AA.

This website

growboost.pl was assessed on 30 September 2026. The project list, the Store Feed page and this policy were tested with axe-core 4.4.3 in Chromium against the WCAG 2.0 and WCAG 2.1 rule sets for levels A and AA, at 1280 px and 390 px viewport widths. No violations were reported.

The following were checked by hand and passed:

• reflow with no horizontal scrolling down to 320 px (1.4.10);
• text enlarged to 200% with no loss of content (1.4.4);
• the WCAG text-spacing overrides - line height 1.5, letter spacing 0.12em, word spacing 0.16em, paragraph spacing 2em - with nothing clipped (1.4.12);
• every control operable from the keyboard, including the screenshot viewer, which traps focus while open and closes with Escape (2.1.1, 2.1.2);
• a visible focus indicator on every focusable element (2.4.7);
• a "Skip to contents" link as the first item in the tab order on every page (2.4.1);
• text contrast of at least 4.5:1 and interface contrast of at least 3:1 (1.4.3, 1.4.11).

This is a self-assessment, not an audit by an outside body, and automated testing cannot cover every success criterion.

The Store Feed widget on your storefront

Lighthouse reported no accessibility issues attributable to the widget when it was measured on a Shopify development store (Savor theme) in September 2026.

One limitation follows from how the widget is designed: on your storefront it takes the background and text colours of the section it is placed in, so the final contrast depends on your theme. The widget switches its text between black and white to stay readable (see section 5 of the documentation), but a colour scheme set to an extreme combination can still fall below the required ratio. If you need the widget to meet a contrast target, check the colour scheme of the section that holds it.

Known limitations of this website

• The screenshots in the gallery are dense composites. Each carries a description in its alt text and a caption, and the same information is written out in the documentation, so nothing is available only as an image - but the pictures themselves are easier to read enlarged (tap or click to open them full size).
• The launch countdown updates every second. It is plain text, it is not the only place the release date is given, and it has no motion beyond the digits changing.

Telling us about a problem

If you meet a barrier on this website or in the app, write to support (at) growboost.pl with the address of the page and what happened. We reply within 24 hours on business days. If we cannot fix something straight away, we will tell you what we will do instead and when.

Statement prepared on 30 September 2026 on the basis of a self-assessment. It is reviewed whenever the website or the app changes substantially.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify merchants of any significant changes by updating the "Last updated" date at the top of this page. Continued use of the App after changes are posted constitutes acceptance of the updated policy.