Privacy Policy

This policy explains how Appnary handles data for its websites and Shopify apps. Appnary is a product of Binary Labs LLC, 1309 Coffeen Avenue, Sheridan, Wyoming 82801, USA (binarylabssoft.com). Binary Labs LLC is responsible for this data.

Website

appnary.com uses Google Analytics (GA4). It sets cookies and records page views so we can see which pages are read. Google handles that data under its own policy.

Waitlist

If you join a waitlist, we store the email address and which product you asked about.

Vigil

Vigil requests theme read access only. It reads the published theme and the store events Shopify returns to the app. It does not request staff, customer, or order data.

For each store, Vigil stores:

• the Shopify access token, encrypted at rest;
• the storefront password, if you save one, encrypted at rest;
• the theme file and line behind each finding, and the original text of any line you turn off so it can be restored;
• storefront HTML from a live-page scan, kept in a cache for up to 60 minutes (the last good copy for up to 7 days);
• a log of scans and changes;
• agent tokens, stored only as hashes. The plain token is shown once;
• for each AI connection, the name of the client, the name or email of the Shopify staff member who connected it, and hashed access and refresh tokens. Access tokens last 1 hour and refresh tokens 30 days. The Shopify token from that sign-in is not kept.

Scans read your storefront as a visitor does, without a customer login.

AI agents you connect, such as Claude (claude.ai, Claude Desktop, Claude Code, with any model including Opus), ChatGPT, Codex, Cursor, or any other MCP client, can read Vigil results for your store: theme findings, script hosts on the live page, change history, and any storefront HTML they upload. Vigil returns this data only when a connected client asks for it. What the client does with it, and how long it keeps it, is set by that provider. Connections are read-only unless you allow turn-off. You can revoke a connection or rotate a token at any time on the Agent page.

Vigil keeps its records while the app is installed. Uninstalling Vigil, or a Shopify shop redact request, deletes that store's Vigil records: tokens, connections, saved passwords, the change log, and turned-off lines. Cached storefront HTML expires within 7 days. Server logs keep the store domain and webhook events for troubleshooting. Other Appnary apps on the store are not affected.

AI review: when a scan flags code, Vigil sends the store domain and a short snippet of each flagged line to an AI provider, which says whether it looks harmful. Appnary's default providers are Anthropic, with OpenAI as backup. If you save your own AI endpoint on the Agent page, Vigil uses that one instead. Snippets come from your theme and public storefront, not from customers.

Host checks: Vigil looks up the registration date of script hosts found on your storefront in public domain registries (RDAP). Only the host name is sent.

Shopify's customer data request and customer redact webhooks are accepted. Vigil holds no customer records, so there is nothing to export or erase for a customer.

Pixel Tracker

Pixel Tracker requests web pixel, customer event, and order read access. It adds the ad and analytics pixels you choose (Google, Meta, TikTok, Pinterest, LinkedIn, Snapchat, X) to your storefront and checkout.

• Pixels load only when the visitor's Shopify privacy choice allows analytics and marketing.
• The visitor's browser sends events straight to those platforms: page views, product views, search terms, add to cart, and purchases (product IDs, names, quantities, prices, order ID, value, currency). The platforms also receive the visitor's IP address, browser details, and their own cookies, under their own policies. This visitor data does not pass through Appnary.
• When an order is paid, Shopify sends Appnary the order ID, total, and currency. Appnary forwards them to your Google Analytics property as a purchase event and does not store them.

For each store, Pixel Tracker stores the store domain, the Shopify access token (encrypted at rest), your plan and Shopify subscription ID, and the pixel and measurement IDs you enter. If you create an Appnary account, it also stores your name, email, and a hashed password. Shopify handles billing; we never see card details.

Uninstalling removes the Shopify token. A Shopify shop redact request deletes the store record and its pixel IDs. Pixel IDs saved to an Appnary account you created stay with that account until you ask us to delete it. Pixel Tracker holds no customer records, so customer data and redact requests have nothing to export or erase.

Sharing

We do not sell your data. Railway (hosting), Resend (email delivery), and the AI providers named above process it only so the site and the apps can run. Pixel Tracker sends data only to the ad and analytics platforms you turn on. AI clients are covered in the Vigil section above.

Where data is kept

Appnary's apps and database run on Railway in the United States (US West). Server logs are kept for up to 30 days, then deleted by the host.

Contact

Questions or deletion requests: info@binarylabssoft.com, or by post to Binary Labs LLC, 1309 Coffeen Avenue, Sheridan, Wyoming 82801, USA.