We hold as little as possible, and none of it is your shoppers.

01Who this covers

BreadCrumbs is a Shopify app built and operated by ShopGears. This policy covers three things: the app you open inside your Shopify admin, the theme block it adds to your storefront, and this website.

It does not cover Shopify itself. Your store, your collections, your orders and your customers are governed by Shopify's own privacy policy and by the agreement you have with them. We only ever see the slice described below.

02What we receive from your store

The app talks to the Shopify Admin API using the permissions you granted when you installed it. It reads what it needs to draw a breadcrumb, and it does not ask for more.

• Store identityYour myshopify domain, store name, Shopify plan and whether the store is a development store. Read the first time you open the app, so we know the install exists — Shopify has no install event for us to listen to.
• Contact addressThe store contact email Shopify holds. It is stored because at uninstall there is no session, no token and no open browser left to ask with.
• Session credentialsA Shopify access token, the scopes it carries and its expiry, so the app stays signed in while you work.
• Collections and productsTitles, handles, ids and images, read live each time you open the tree editor to draw the picker and the preview. They are not copied into our database.
• Themes and templatesTheme names, ids and the storefront template JSON the setup checklist reads to tell you whether the breadcrumb block has been added to a page.

03What stays in your own store

Everything you configure is written to app-owned metafields on your shop: the category tree and its display names, the per-theme separator styles and overflow behaviour, the resolved path on each collection, and the entitlements your plan unlocks.

We keep no second copy. It is your data, sitting in your store, read straight from Liquid by your own theme. That is also why the storefront keeps working if our servers do not — the trail is rendered from your store, not fetched from ours.

04Your storefront visitors

The theme block renders a breadcrumb trail in the shopper's browser. It does not identify anyone, set advertising cookies, fingerprint devices, or send us anything at all about who is browsing your store.

• The visitor pathOptional, and off unless you deliberately switch it on. When it is on, the block remembers the route through your store for the length of that one visit, in the shopper's own browser. It expires with the visit, is capped at a handful of steps, and is never transmitted to us.
• Structured dataIf you enable BreadcrumbList markup, the trail is published in the page's HTML so search engines can read it. It describes your categories. It never describes a person.

05Why we hold what we hold

• To run the appStore identity and session credentials, so the app opens, authenticates against the right store, and can write your settings back.
• To support youStore domain, name, plan and contact address, so a conversation starts with us already knowing which store is asking rather than a visitor number.
• To tell you things that matterOne welcome message at install, one confirmation at uninstall, and occasional in-app notices about the app itself.
• To bill correctlySubscription status delivered by Shopify's billing webhook, so paid features unlock on paid plans. We never see a card number — Shopify takes the payment.

06Cookies and tracking

• This websiteSets no cookies and runs no analytics, no tag manager and no advertising pixels. Nothing here follows you anywhere.
• The app in your adminAuthenticates with the short-lived session tokens Shopify's App Bridge issues on each request. It sets no cookies of its own.
• The Support screenLoads the Tawk.to chat widget, which sets its own storage so a conversation holds together across visits. It loads only when you open Support, and not before.
• Your storefrontThe breadcrumb block sets nothing. The optional visitor path uses in-browser session storage that the browser discards when the visit ends.

07How long we keep it

• While the app is installedYour install record and current session, for as long as BreadCrumbs is on the store. Sessions expire on their own and are replaced as you use the app.
• The moment you uninstallShopify notifies us, we clear the access tokens immediately and mark the store uninstalled. Your metafields are removed by Shopify along with the app.
• After you have goneWe keep the install record — domain, store name, contact address, install and uninstall dates — so that a reinstall picks up where you left off and so we do not send you the same welcome message twice. Ask us and we delete it.
• Support conversationsTranscripts sit in Tawk.to under their retention policy. Ask us and we delete the conversation.

08How it is protected

• Every request is verifiedWebhooks are HMAC-checked against the app's own secret before anything is read from them, and every admin request carries a session token whose signature, audience and expiry we verify before a screen renders. A request that fails either check is rejected, not logged in and hoped about.
• You can only read your own dataThe store is always taken from the verified session token, never from the request body or a query parameter. There is no store id to guess and no field to tamper with.
• Secrets stay on the serverAPI credentials are read at request time on the server and are never shipped in the browser bundle.
• Encrypted in transitAll traffic between your admin, our servers and Shopify runs over TLS.

09Your rights over this data

Depending on where you are — the EEA and the UK under the GDPR, California under the CCPA and CPRA, and comparable laws elsewhere — you can ask us to do any of the following with the information we hold about you.

• See itA copy of everything we hold that relates to your store.
• Correct itFix anything wrong, most often a contact address that has moved on.
• Delete itErase the install record entirely. Note that this is separate from uninstalling, which removes the app but leaves the record described above.
• Take it elsewhereReceive it in a portable, machine-readable format.
• Object or restrictTell us to stop a particular use, or to hold the data without using it while a question is settled.

Write to us from the address on the store account and we will answer within 30 days. Exercising any of these rights is free, and we will not treat you differently for having asked.

10Where the data sits

Our database and the services named above are run by providers who may process data in the United States and in the European Union. Where personal data moves out of the EEA or the UK, that transfer is covered by the providers' Standard Contractual Clauses.

11Children

BreadCrumbs is a tool for merchants and is not directed at anyone under 16. We do not knowingly collect information from children. If you believe a child's information has reached us, write to us and we will remove it.

12Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change materially affects what we do with your data, we will tell you inside the app before it takes effect rather than quietly editing this page.

Continuing to use BreadCrumbs after a change takes effect is how you accept the new version.