Privacy Policy

Last updated 15 August 2026

Kit Ledger is an inventory app for Shopify merchants. It tracks the components that go into the products you sell. This policy describes what the app stores, why, and how to have it deleted.

What we store

When you install Kit Ledger, we store the following for your shop:

• Shop and session data — your .myshopify.com domain, install and uninstall timestamps, your app settings, and the access token Shopify issues so the app can read and adjust inventory on your behalf.
• Staff sign-in details — when someone on your team opens the app, Shopify’s session record we store also holds that person’s first and last name, email address, locale, and whether they are the account owner or a collaborator. This is how the app knows who took an action. These are your staff’s details, not your customers’.
• Catalog references — product variant, inventory item, and location identifiers, plus cached variant titles so recipes are readable.
• Your recipes — the components and quantities you define, including names, units, on-hand counts, and low-stock thresholds for materials you track inside the app.
• The ledger — one append-only row per inventory movement: the order and line item it came from, the location, the quantity, the reason, the recipe version used, and who or what caused it. Where a staff member triggered an action in the app, that row records the email address of the Shopify user who took it.
• Reconciliation records — the last reconciled quantity per item and location, open drift alerts, and a log of nightly runs.
• Webhook processing records — the identifiers of webhooks Shopify has delivered, used to guarantee each event is applied exactly once.

What we do not store

Kit Ledger does not request field-level access to protected customer data, and it does not store your customers’ names, email addresses, phone numbers, or shipping and billing addresses. It holds no payment card data — billing runs entirely through Shopify. It adds nothing to your storefront and sets no tracking cookies there.

The app can record raw webhook bodies to build a replay corpus for testing. Whenever that is enabled, customer, contact, address, and line-item personalization fields are stripped before anything is written to the database, so no customer information is captured either way. It is currently switched off in production.

Where it lives, and who else touches it

Data is stored in a PostgreSQL database hosted on Railway in the United States and travels over TLS. We share it with no one except the providers needed to run the service:

• Shopify — the source of order and inventory events and the destination of inventory adjustments.
• Railway — application and database hosting.
• Resend — delivery of the alert emails you opt into (low stock, detected drift). These contain item names and quantities, never customer information.

We do not sell your data or use it to train anything.

Retention and deletion

Uninstalling the app does not immediately erase your ledger: history is deliberately preserved so a reinstall or an export is still possible, and so your audit trail does not vanish on a misclick. Shopify sends us a shop/redact request 48 hours after uninstall, and on receiving it we permanently delete every record belonging to your shop — recipes, ledger, reconciliation records, sessions, and webhook records — in a single transaction.

We respond to Shopify’s mandatory customers/data_request and customers/redact requests as well; because we hold no customer personal data, there is nothing for us to return or erase in response to those.

Making a data request

To ask for a copy of your data, for early deletion, or for correction of a staff member’s details, email support@getkitledger.com with the subject line Data request and include:

• your shop’s .myshopify.com domain;
• what you want — a copy of your data, deletion, or correction — and, if it concerns one person, their name and email as it appears in the app;
• a reply address we can use, sent from an address on the shop’s account so we can confirm you are entitled to make the request.

We acknowledge within 5 business days and complete the request within 30 days. One limit worth stating plainly: the ledger is append-only by design, so individual rows cannot be edited or removed. A request to erase a staff member’s details from historical ledger rows is satisfied by deleting the shop’s data in full, which is what a shop/redact or an early-deletion request does.

Security

The ledger is append-only and enforced as such by the database itself: rows cannot be edited or deleted, and corrections are recorded as new entries. Inventory adjustments are written as deltas, so a repeated or out-of-order event cannot silently overwrite your counts. Access tokens are stored server-side and are never exposed to the browser.

Changes

If this policy changes materially, we will update the date above, show a notice inside the app, and email you where we hold a contact address for you, before the change takes effect.

Contact

Questions or requests: support@getkitledger.com.