sK Spin Wheel Popup – Privacy Policy

Last updated: 28 September 2026

sK Spin Wheel Popup shows a spin-to-win popup on your store. Visitors spin a wheel for a discount code you created, and can leave their email to claim it. This policy explains what the app stores, what it counts, and what it never touches.

Visitor emails

Emails entered in the popup are sent by the visitor's browser directly to your store's own Shopify newsletter form (/contact, the same form your theme's newsletter signup uses). The customer record is created in your Shopify admin. Emails never reach our servers and we do not store, see or process them. If you show a consent checkbox, the email of a visitor who does not tick it is not sent to Shopify at all; the visitor still receives the code.

What the app stores

• Your store domain (for example your-store.myshopify.com).
• The offline access token Shopify issues at install.
• Your wheel settings: prizes, odds, discount codes, texts, colours and display rules.
• Anonymous daily totals: how many times the popup was shown, spun, closed and led to a signup, and how often each prize came up. These are plain counters per store and day. They contain no email, name, IP address, cookie identifier or any other information about a visitor.

What the app reads but does not store

With the read-only read_discounts access scope, the app looks up the discount codes you placed on the wheel: whether they exist, whether they are active, how many times they were used and the sales Shopify attributes to them. These figures are shown in the app and not stored.

What the app never accesses

• No customer records, orders, addresses or payment data. The app requests no customer or order access scope.
• No tracking of individual visitors. To remember that a visitor already spun, the popup keeps a small record in that visitor's own browser (localStorage). It is never sent to us.

Shopify’s mandatory privacy webhooks

• customers/data_request — the app holds no customer data, so there is nothing to return.
• customers/redact — the app holds no customer data, so there is nothing to delete.
• shop/redact — your store record, settings and counters are deleted.

Where data is stored

Your store domain, access token, settings and counters are held in a Postgres database hosted in the European Union (Frankfurt region). Data is transmitted over TLS.

How long data is kept

Your access token is deleted immediately when you uninstall the app. Your store record, settings and counters are deleted when Shopify sends the shop/redact request, which happens 48 hours after uninstall.

Sub-processors

Provider	Purpose	Location
Shopify	App platform	Global
Neon	Postgres database	EU (Frankfurt)
Vercel	Application hosting	EU

No other party receives any data.

Changes to this policy

If this policy changes in a way that affects what we store, we will update the date at the top of this page.

Contact

Questions about this policy: info@saitkatmerlikaya.com