Privacy Policy

Pick & Animate

Last Updated: July 31, 2026

This Privacy Policy describes how eCommerce360 (“we”, “our”, or “us”) collects, uses, stores, and protects information when you install or use the Pick & Animate Shopify application (“App”).

The App allows Shopify merchants to select elements of their storefront with a visual picker and apply animation effects to them — add-to-cart flight tiles, seasonal decorations, scroll and text reveals, image and button hover effects, and free-shipping badges. Those effects are delivered to the storefront through a theme app embed.

This policy covers both the merchant who installs the App and shoppers who visit a storefront where the App’s theme app embed is enabled. It does not cover Shopify’s own data practices, which are governed by Shopify’s Privacy Policy.

By installing or using the App, you agree to the practices described in this Privacy Policy.

1. Information We Collect

We collect only the information necessary to provide the App’s functionality. The App requests exactly one Shopify Admin API access scope: read_themes. We request no write scopes, and we never modify a merchant’s theme files.

a) Store and Theme Information

When you install the App, we receive certain information from Shopify, including:

• Shopify store name
• myshopify.com domain
• Shopify authentication data and access tokens
• App installation status

The read_themes scope is used for two reads against the published theme’s config/settings_data.json:

• App embed detection. We check whether the merchant has enabled the “Pick & Animate” app embed in their theme editor, so the admin can show an accurate status (“enabled” / “please enable this in your theme editor”) instead of a false promise that effects are playing.
• Brand token extraction. We read six values that describe the store’s visual brand: accent colour, background colour, foreground colour, heading font, body font, and corner radius.

Of the brand tokens, only the accent colour is ever sent to the storefront — it is used to colour the add-to-cart flight tile, the free-shipping badge and confetti, and one seasonal preset, so those effects match the store instead of shipping a hardcoded colour. Background and foreground colours are used only internally to check colour contrast (WCAG) against that accent. The remaining tokens (fonts and corner radius) are stored but are not currently used by any storefront-facing feature.

b) Effect Configuration

The App stores the animation settings a merchant chooses, including:

• which storefront elements are animated
• effect style, direction, and speed
• colours derived from the brand tokens described above
• thresholds and schedules
• decoration placements

This configuration is stored both in our database and as Shopify metafields owned by the App, under the namespace $app:pickanimate. Metafields are how the published configuration reaches the storefront; our database holds the admin’s working copy of the same data. None of this data identifies an individual shopper — it describes store-level settings only.

c) Operational and Technical Data

We store limited operational data necessary for secure App operation, including:

• Shopify OAuth session information, including the store’s access token, which is required for the App to make authenticated Admin API calls
• installation status
• error and system logs necessary for troubleshooting and service reliability

d) Data We Do NOT Collect

The App does not collect, read, or store:

• customer personally identifiable information of any kind — name, email, address, phone number, order history, or browsing history
• payment or checkout data. The App observes that an “add to cart” action occurred, by watching for a successful POST /cart/add request in the shopper’s browser, purely to trigger a cosmetic animation. It never reads the contents of the cart or checkout, and it never interferes with or delays that request.
• analytics, tracking pixels, advertising identifiers, or third-party marketing data
• advertising profiles about store visitors or customers

No AI models are called by any part of the App, and no data is sent to any third-party AI service. The App sets no cookies on the storefront. We do not request or use write_themes, write_products, customer data scopes, order scopes, or any other Admin API permission. We also do not sell merchant or customer information.

2. How the Storefront Code Works

The App adds a single theme app embed. When enabled, it loads only the small, conditionally loaded scripts needed for the effects a merchant has actually published — add-to-cart, seasonal, scroll and text reveal, image hover, button hover, or free-shipping. Each script runs under its own performance budget, and none is loaded if the corresponding effect is not active.

These scripts:

• read the App’s own metafields to know what to animate and how
• watch for scroll position, pointer hover, and successful add-to-cart events, entirely in the shopper’s browser
• never send any of this information to our servers. Storefront playback is local to the shopper’s browser; the App’s server is not involved in, and does not log, individual page views, scroll behaviour, hovers, or cart actions.
• make no requests to any third-party network endpoint. Built-in decoration graphics (Twemoji, licensed CC-BY 4.0) and the runtime scripts themselves are served from Shopify’s own asset CDN, not from our infrastructure or any third party.

3. The Element Picker

When a merchant uses the visual picker to choose which storefront element to animate, the picker opens the merchant’s own storefront in a popup window — not an iframe, since Shopify storefronts disallow embedding — and records only a structural reference to the clicked element:

• a section id
• a path of child indices
• a small fingerprint consisting of tag name, classes, a text hash, and child count

This is not a screenshot, a URL history, or any shopper-identifying data. It describes the shape and location of a theme element the merchant selected, and it is used solely to apply the chosen animation to that element and, for image and button effects, to other elements that share its shape.

4. How We Use Information

We use collected information solely to:

• authenticate merchants and maintain secure App sessions
• detect whether the theme app embed is enabled and report accurate status in the admin
• match animation colours to the store’s brand and verify colour contrast
• save and publish the animation settings a merchant configures
• apply chosen effects to the storefront elements a merchant picked
• provide customer support
• diagnose technical errors and security issues
• improve the reliability and performance of the App
• comply with applicable laws and legal obligations

5. Data Storage

The App maintains a small managed Postgres database with two categories of stored data, both scoped to the shop, never to individual shoppers: session data and effect configuration, as described in Section 1.

Effect configuration is additionally stored as Shopify metafields under the App-owned $app:pickanimate namespace, which is how the published configuration reaches the storefront.

We implement reasonable technical and organizational safeguards designed to protect stored information from unauthorized access, disclosure, alteration, or misuse.

6. Data Sharing and Disclosure

We do not sell, rent, or share merchant or shopper data with third parties, and we do not share data for advertising or marketing purposes.

The only party we share data with is Shopify itself, as necessary to operate the App through Shopify’s platform — for example, storing configuration as Shopify metafields. We do not use sub-processors that receive merchant or shopper data.

We may disclose limited information only:

• when required to comply with applicable laws, regulations, court orders, or legal processes
• when necessary to investigate fraud, abuse, security threats, or technical issues
• when necessary to protect our rights, users, systems, or property

7. Data Retention and Deletion

We retain merchant and App-related information only for as long as reasonably necessary to operate the App and provide its services.

When the App is uninstalled:

• Shopify sends the App an app/uninstalled webhook, which clears the store’s session from our database
• metafields stored under the $app: reserved namespace — Shopify’s designated form for app-owned data — are removed automatically, so no configuration data is left behind on the store
• database records tied to the store, covering session and stored effect configuration, are deleted or rendered inaccessible, and are not retained beyond what is needed to support reinstallation support requests

A merchant may request earlier deletion of any stored data at any time by contacting us using the details below.

8. Data Security

Access tokens and configuration data are stored in a managed Postgres database with restricted access, and all communication with the Shopify Admin API and between the merchant’s browser and our admin application occurs over HTTPS.

Our safeguards include:

• HTTPS and TLS encryption for data transmitted over the internet
• secure Shopify OAuth and session-token authentication
• restricted access to databases and production systems
• secure hosting infrastructure
• application monitoring and logging
• regular software and security updates

We follow the principle of least privilege: the App requests only the read_themes scope and no write access to any store data.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• request access to information we hold about your store
• request correction of inaccurate information
• request deletion of your information
• object to or restrict certain processing activities
• request a portable copy of your stored information
• submit a complaint to a relevant data protection authority

To exercise your rights, contact us using the information provided below. We may need to verify your identity before completing your request.

10. GDPR and International Processing

Where applicable, we process information in accordance with the European Union General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA”), and other applicable privacy laws, under lawful bases including performance of a contract, legitimate business interests, and compliance with legal obligations.

Because the App does not collect or process shopper personal data, data transfer obligations are limited to the merchant and session data described in Section 1, which is processed on the infrastructure described in Section 8. Infrastructure providers used by the App may process this data in jurisdictions other than your own.

We do not sell or share personal information for cross-context behavioral advertising.

11. Children’s Privacy

Pick & Animate is a business tool intended for use by Shopify merchants and is not directed to children. Because the App does not collect shopper personal information at all, it does not knowingly collect data from children.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the App, our practices, or applicable legal requirements.

Changes will be published on this page with a revised “Last Updated” date. Continued use of the App after an updated policy becomes effective indicates acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or to request access to or deletion of data associated with your store, contact us: