Cart Relay — Privacy Policy

Last updated: July 2026. Cart Relay is operated by Flywheel Systems.

Cart Relay keeps a signed-in shopper's cart in sync across their devices and browsing sessions. This policy explains exactly what data the app handles and why.

What we collect

When a logged-in customer shops on a store that uses Cart Relay, we store:

• the customer's Shopify customer ID (a number), used only to match a saved cart to the right shopper;
• the contents of their cart — product and variant IDs, quantities, line item properties, and the cart note and attributes;
• a per-browser device identifier generated by the app (a random value, not read from the device), and anonymous product-usage events (e.g. that a cart was synced);
• a coarse device label such as “Chrome on Mac”, derived from the browser's user-agent string. Only the browser family and operating system family are kept — no version numbers and no device fingerprint. It exists so the merchant's activity feed can say which browser a cart moved between.

We do not store customer names, email addresses, phone numbers, shipping addresses, or payment information. One qualification, stated plainly: the orders/create webhook Shopify sends us includes the order's customer object. Where Shopify includes contact details in it, we read only the customer ID; any other field is never stored, never logged and never sent anywhere, and is discarded with the rest of the payload once the webhook has been handled.

How we use it

Cart data is used for one purpose: to restore a shopper's cart when they return or switch devices. We also compute aggregate, non-identifying metrics for the merchant's dashboard (number of cart transfers, orders matched to a saved cart, and the order value of those orders). We do not sell or share personal data, and we do not use it for advertising.

Merchant data

For each store that installs the app we store the shop's myshopify domain, app settings, and an offline access token used to operate the app. We receive orders/create webhooks (order id, cart token, order total, currency, creation time and the customer object) to empty a purchased cart so it is never restored afterwards, and to match the order to the saved cart it came from. The app is hosted on Heroku, with data stored in MongoDB Atlas and Redis.

Retention & deletion

Saved carts are automatically deleted after 12 months of inactivity. The merchant-facing activity feed keeps its events for 90 days and then deletes them automatically; the dashboard totals are unaffected by that expiry. We fully support Shopify's mandatory privacy webhooks: customers/redact deletes a shopper's saved cart and scrubs their identifiers, customers/data_request produces an export of the data we hold for that shopper, and shop/redact deletes all of a store's data when the app is uninstalled.

Contact

Questions about this policy or your data? Email grc.ds@proton.me.