Privacy Policy

What we access in your Google Account

Syncline requests a single Google Drive permission, drive.file. This is Google's narrowest Drive scope: it grants access only to files this app itself creates. Syncline cannot see, list, open or search any other file in your Drive, and cannot access a spreadsheet you made yourself unless you explicitly hand it to us.

We deliberately do not request the broader spreadsheets or drive scopes, which would grant access to your entire Drive.

We also request openid, email and profile solely to show which Google account is connected, so you can confirm you linked the right one.

What we store

• Your Shopify store domain and the access token Shopify issues when you install the app.
• Your Google account email and OAuth tokens. Tokens are encrypted with AES-256-GCM before being written to our database and are never logged or displayed.
• The ID of the spreadsheet we create for you, its column configuration, and a shared secret used to authenticate the optional Apps Script.
• Product and variant sync state: Shopify product, variant and inventory-item identifiers, the sheet row each maps to, cryptographic hashes of the synced field values, and timestamps. Hashes let us detect what changed without retaining a second copy of your catalogue.
• Activity logs describing sync events and errors, so you can audit what changed and diagnose problems.

What we never collect

Syncline requests no access to customers, orders, or payment data, and holds none. Its Shopify permissions are limited to products, inventory and locations.

How we use it

Solely to operate the sync you configured: reading products from Shopify to write them to your sheet, reading your sheet to update Shopify, and showing you the resulting status and history.

We do not sell your data, share it with advertisers, use it for advertising or profiling, or use it to train machine-learning models. Google user data obtained through Syncline is used only to provide this functionality and is handled in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Where it is stored

Data is stored on Cloudflare's infrastructure and processed in Cloudflare Workers. Sub-processors are Cloudflare (hosting and database), Shopify (the store you connect) and Google (the Drive account you connect).

Retention and deletion

Uninstalling Syncline from your Shopify store stops all syncing immediately. Your configuration is retained for up to 30 days so a reinstall can resume where you left off, then deleted.

You can revoke Syncline's access to your Google account at any time at myaccount.google.com/permissions. Doing so stops syncing at once; spreadsheets we created remain in your Drive and stay yours.

To request immediate deletion of all data we hold about your store, email syncline@secondactlabs.io from the address associated with the account. We action such requests within 30 days.

Security

All traffic is served over HTTPS. Google refresh tokens are encrypted at rest with AES-256-GCM using a key held separately from the database. Requests from the Apps Script integration are authenticated with a per-store shared secret compared in constant time.

Contact

Questions, access requests, or deletion requests: syncline@secondactlabs.io.