Privacy Policy

The short version

We hold your email address, what you asked us to build, and the API credentials you give us for your own Shopify and supplier accounts. We do not sell anything to anyone. We measure how the site is used and how our ads perform, with Meta's pixel and Microsoft Clarity, as described under "If you only visit" and "Cookies" below.

Your store credentials — the important part

To build in your store we hold a Shopify Admin API token and, for dropshipping stores, a CJ Dropshipping API key. These are powerful: the Shopify token can read and change your products, pages, theme and orders.

They are encrypted at rest and stored separately per store. They are used only to carry out what you asked for — building your store, applying your change requests, and placing the supplier orders your shoppers pay for.

You can revoke them yourself at any time, without us, by deleting the app in your Shopify admin or the key in your CJ account. That is the strongest control here and it does not depend on us doing anything.

This service runs on hardware the operator controls rather than a large cloud provider. We think you should know where your credentials physically are.

What else we hold

Your email address and a hash of your password (never the password).

Your briefs and change requests — the text you write to describe what you want — and a record of what was built.

Counts of metered actions (stores built, changes, videos) so plan allowances can be applied, and a payment status. Your card details are handled by Shopify or Stripe and never reach us.

Server logs, which include IP addresses, kept so failures can be diagnosed. They roll over by size, which is usually within a few weeks.

If you only visit

The demo-store box keeps what you wrote and your IP address, so a demo can be shown to you and so one visitor cannot make unlimited demos. If you do not sign up to keep it, the demo and that record are deleted after 7 days.

The questions box sends your question to Google's language model to write the answer. We do not store the question; we keep your IP address only for the 15 minutes our rate limit counts over.

A rating keeps the stars, any words you write and the name you give. Nothing is shown until we approve it.

The waitlist, when it is open, keeps your email address to tell you when signups open.

Measurement. When our ad measurement is switched on, Meta's pixel reports which steps you take here — a page view, starting and sending a brief, a demo store shown, signing up, connecting a store — to Meta, together with your IP address, your browser and Meta's own cookies, and after you sign up a hashed copy of your email address, so we can tell whether our ads bring people who build stores. Microsoft Clarity records how pages are used (scrolling, taps, session replays) with the text you type masked. Neither is loaded for visitors in the EU, the UK or Switzerland.

Who else sees it

Shopify and CJ Dropshipping — your own accounts, where the work happens.

Google (Gemini) — your brief, change requests and questions are sent to a language model to generate the brand, copy, product selection and answers. Do not put anything confidential in a brief.

Shopify Billing — charges for the orders we place go on your store's Shopify invoice, approved by you in your admin.

Stripe — payments for accounts that set up a card there before billing moved to Shopify, handled end to end.

Cloudflare — every request to this site passes through Cloudflare's network, which sees your IP address. Cloudflare also runs the check that you are not a bot on our forms, counts page visits without cookies, and stores the waitlist.

Google (Gmail) — the email provider for verification, password resets and trial reminders.

Meta and Microsoft (Clarity) — ad and usage measurement, as described above, when switched on.

Nobody else. We do not sell or share your data, and we do not use it to train anything.

Deleting everything

There is a delete button on your dashboard. It erases your account, your stores' records, your briefs and change history, and the credential files holding your encrypted tokens — not a flag marking them deleted; the rows and the files go.

Your Shopify store and its contents are untouched, because they are yours and always were.

You can also ask us: yonacohen991@gmail.com. Wherever you live, you can ask to see the data we hold about you, have it corrected, get a copy, or have it erased, and you can object to how we use it; the delete button is the fastest route to the last one. You can also complain to your data protection authority — in Israel, the Privacy Protection Authority.

Backups are kept for 14 days and then deleted, so a copy of deleted data may remain in a backup archive for up to 14 days.

Cookies

One cookie of ours, named session. It keeps you signed in and protects our forms from being submitted by another site on your behalf, so pages with a form set it even before you sign in. It is strictly necessary for the site to work.

When ad measurement is switched on, Meta's pixel sets _fbp and _fbc and Microsoft Clarity sets _clck and _clsk, to recognise the same browser across visits. They are not loaded for visitors in the EU, the UK or Switzerland, where consent would be required — which is why Storecraft has no cookie banner to click: where one would be needed, nothing that needs one is loaded. Our fonts are served from this site, not from Google.

Contact

Questions, or a request about your data: yonacohen991@gmail.com. This service is operated by the operator of this service.