Privacy policy

Who we are

COD Control (“the app”) is a Shopify app that controls where Cash on Delivery appears at checkout and optionally adds a COD handling fee to orders. Contact: support@codcontrol.app.

What we store

• Your store’s myshopify.com domain and an API access token Shopify issues to the app on install.
• Your rule configuration (countries, cart limits, fee settings), stored in your own store’s data via Shopify metafields.
• Install state: your app plan, when the app was installed, and a count of orders where the fee was skipped.
• Short-lived webhook delivery IDs and order IDs, kept to prevent processing the same order twice.

What we process but do not store

When the fee feature is enabled, Shopify sends the app a minimal order notification containing the order ID, payment method names, currencies, the buyer’s language, the shipping address, financial status and order tags. The app uses these in the moment to decide whether to add the fee line, then discards them. We deliberately do not request customer names, emails or phone numbers.

Where data lives

The app runs on Cloudflare Workers, and install state is stored in Cloudflare D1. Rule configuration lives inside Shopify’s own platform (metafields on your store).

What we never do

• No selling or sharing of data with third parties.
• No analytics or tracking scripts in your storefront or checkout.
• No marketing email — we email you only for support or critical service notices.

Deletion

Uninstalling the app invalidates its access token immediately. Shop data is deleted when Shopify sends the shop-redact notice (48 hours after uninstall). We honor all Shopify GDPR webhooks: customer data requests (we hold no customer profiles to return), customer redaction, and shop redaction.

Changes

If this policy changes materially, the effective date above changes and the prior version remains available on request.