CodeGuard privacy policy
ExtStore CodeGuard (discount guardrails), by ExtStore. Last updated 2026-10-22.
CodeGuard is a Shopify app that adds guardrails to discount codes (excluding items on sale, caps, cart limits, exclusions and, on the Pro plan, first-order and per-customer limits, a margin floor and alerts for codes that may have leaked). This policy explains what store data the app reads and stores, why, and for how long.
Data we access
- Discounts and discount codes (to create, convert, restore and keep guarded codes in sync).
- Product and variant facts: price, compare-at price, tags, vendor, product type, collections (to test codes and display your settings).
- Pro plan, only after you grant the optional permissions: orders that used a discount code (line prices, compare-at prices and the discount on each line), and the customer ID of those orders (to count uses per customer). When a converted code was already limited per customer, CodeGuard reads the last 60 days of orders that used it, so customers who already used it keep their count.
- Pro plan, only after you grant the optional permission to edit products: each item’s cost, copied into an app-owned field on the variant so the margin floor works at checkout. Nothing else on your products is changed.
- Each guarded code’s total use count from Shopify, checked every hour for leak alerts (Pro). No customer or order data is used for this.
Data we store
| Data | Purpose | Retention |
|---|---|---|
| Store domain, plan, settings, guarded discount settings and codes | Running the app | Until 48 hours after uninstall (Shopify’s shop/redact request), then deleted |
| Order IDs with discount totals (no names, addresses, emails or phone numbers) | Margin report (Pro) | 13 months, or until a redact request |
| Customer IDs with a use count per code | Uses-per-customer limits (Pro) | Until the customer or store is redacted |
| Customer data request exports (customer and order IDs, use counts and discount totals only) | Merchant download of Shopify customer data requests | 90 days, or until the customer or store is redacted |
| Guardrail presets and code rules for regular Shopify codes (codes and amounts, no customer data) | Reusing guardrails; refusing codes at checkout that break their rules | Until you delete them in the app, or until the store is redacted |
| Hourly use counts per guarded code | Leaked-code alerts and the weekly summary (Pro) | 9 days |
| Leaked-code alerts (code and use counts) | Alert banners and history (Pro) | Until the store is redacted |
| Item costs (not personal data), in an app-owned field on each variant in your store | Margin floor at checkout (Pro) | Kept in step with your costs every 15 minutes; removed when you clear a cost |
| Webhook delivery IDs | Processing each Shopify notification once | 7 days |
| Background job records (order and customer IDs only) | Processing orders and requests in the background | 1 hour after success; 14 days after a failure, or until a redact request |
Deleted data can remain in our encrypted database backups for up to 14 days, after which those backups are deleted. Backups are never used to restore data that was deleted because of a redact request or an uninstall.
CodeGuard does not store customer names, email addresses, phone numbers or addresses. Per-customer use counts are also written to an app-owned customer metafield so the discount function can read them at checkout.
How data is used and shared
Data is used only to provide CodeGuard’s features to the store that installed it. If you use Shopify Flow, CodeGuard sends its two Flow triggers (a code’s use spiked, and the weekly summary) to your own store’s Flow with code names, use counts and totals only. We do not sell data, use it for advertising, or share it with third parties. Data is stored on servers we operate. Shopify access tokens are encrypted by the app before they are stored; the database and its backups are encrypted at rest by the hosting disk, and backups are kept for 14 days.
Your requests
CodeGuard handles Shopify’s privacy requests automatically: a customer data request produces an export of the IDs and counts we hold (downloadable by the merchant in the app’s Settings), a customer redact request deletes that customer’s data, and a shop redact request deletes all of the store’s data.
Contact
Questions about this policy: support@extstore.com.