Bracket privacy policy

Last updated 10 October 2026 · Bracket is this Shopify app's public name. In this policy, "we" means the app operator.

What the app accesses

• Your theme files, read and written through Shopify's Theme API with your authorization. Changes are only ever staged to unpublished copies of your theme; we never modify or publish your live theme ourselves.
• Your shop domain, installed theme details, and app plan status.
• The store owner email address, used for service messages and, only when you opt in, product emails.
• Aggregate storefront performance metrics (for example page speed) from your public storefront.

What the app never accesses

The app does not request Shopify API access to customers, orders, or payment information. If Shopify sends a customer data request or redaction webhook for your store, the app records the compliance event but has no customer record to return or erase.

What we store

• Encrypted API access and refresh tokens for your store and, if you provide one, an encrypted storefront password.
• Content-addressed scan and pre-change theme snapshots used to analyse and safely stage changes.
• Verification screenshots, diffs, checks, and technical evidence for staged changes.
• Scan results, recommendations shown to you, and your accept or decline decisions.
• Optional AI explanations and source reviews, the processing description you accepted, and request records used to limit spending and prevent duplicate calls.
• Maintenance requests you submit, including the attached report, selected findings, desired outcome, acknowledgements, replies and proposed scopes. We record a pseudonymous identifier derived from your authenticated Shopify user and store to attribute these actions.
• Approved maintenance scopes, source-processing consent, included work records, AI processing receipts, private problem reports and their recorded job context. Problem reports do not authorize a new charge or change.
• When a supported repair attempt fails, a small private record of its original and proposed JSON, exact source and scope, and AI processing receipt. Optional failure analysis has its own consent.
• Service-email records, consent and unsubscribe preferences, webhook identifiers, and operational telemetry.

How your data is used

We use this data to authenticate the app, scan themes, stage and verify changes you request, prevent duplicate work, operate the service, and contact you about your store. We do not sell merchant data or use merchant theme source to train machine-learning models. We disclose the minimum necessary data to the service providers below so they can operate the app for us.

Optional AI explanations

If you request an AI explanation and agree to the processing description, we send finding categories, counts, and recorded check coverage to Anthropic. We do not include theme source, file names, shop identifiers, credentials, or customer data in this request. You can read and download the recorded report without requesting an AI explanation.

Anthropic processes these inputs and its generated explanations under its commercial API terms. Its standard API policy deletes inputs and outputs within 30 days, with exceptions including legal requirements and usage-policy enforcement. See Anthropic’s retention policy. We do not claim zero retention for this service.

Optional AI theme-code review

A free theme-code review has its own consent, separate from an explanation of recorded findings. When you request it, Bracket selects bounded code excerpts from the saved theme snapshot and sends those excerpts, file names and line references to Anthropic. A second, independent AI call receives the same excerpts and proposed findings to check their evidence. We record the consenting Shopify user's pseudonymous identifier, source identity, coverage, retained findings and processing receipts with the review. The portable report contains findings, references and coverage; it does not include a copy of the source excerpts.

Selection excludes known secret patterns and designated merchant-data files, but code can still contain store content or personal information. Automated filtering cannot guarantee their removal. Bracket does not give the model its Shopify access credentials or administration tools, or add account or store identifiers as request metadata. Identifiers embedded in selected code or file names can still be included. The commercial processing and retention terms described here apply to both calls. This review does not authorize a repair or publish a change. You can use the recorded checks without requesting it.

AI preparation and independent review

Maintenance work has a separate approval from optional explanations and theme-code reviews. Before you approve a proposed change, we describe the files it may affect and ask you to confirm your rights to share the theme source. The AI repair service is not enabled until its processing configuration is verified.

For approved work, Bracket sends Anthropic the selected theme file contents, theme file names, the proposed scope, recorded findings and the checks to perform, including a correction description you explicitly add to a revised scope. A separate review receives the proposed changed files and verification plan. Final delivery review makes a further AI call with bounded storefront screenshots, rendered text, asset observations and the approved source and scope to assess the checked preview. Private problem reports are not automatically copied into any of these calls. Theme source and captured storefront content can contain private material embedded by a merchant or theme author; please do not add credentials or customer details to requests. Bracket does not give the model access to your Shopify token, store administration or publishing controls. AI output can be wrong; additional checks and your review of the unpublished preview remain necessary.

Anthropic is the configured commercial API processor for preparation, independent change review and final delivery review. Its commercial terms and training policy say that commercial inputs and outputs are not used for model training by default. Different rules can apply to data voluntarily submitted to Anthropic as feedback. Bracket does not forward merchant problem reports through Anthropic’s feedback tools. The retention policy linked above applies; we make no zero-retention or UK-only processing promise.

Reporting a problem with included work

A problem report is stored privately with the included job and its recorded source version. We use it to investigate your report and improve the service. Its free text is not put into public logs, a shared prompt or a model-training dataset. Cross-store quality summaries contain categories and counts, not your report text, store identity, theme paths or source. Reporting an issue does not add a charge or automatically authorize a further theme change.

Optional learning from a failed repair

Where a supported failed JSON repair is available, you can separately agree to AI failure analysis. Bracket sends Anthropic the bounded original and failed proposed code, their file names and recorded mismatch. One AI run creates a small invented example; another checks whether it represents the failure without copying private material. Your problem report text is not included. Linking a report identifies the failed attempt; it does not replace this consent.

Only the invented example and reviewed general repair guidance can enter shared quality checks. We test the previous repair configuration and all retained regression cases before adopting new guidance. A failure we cannot reproduce or a failed review produces no update. This improves Bracket’s instructions and tests; it does not train the provider’s model, authorize a new theme change or add a charge. This optional flow is unavailable until its processing configuration is verified.

Deletion

A valid uninstall webhook revokes our durable access and removes the app's stored Shopify sessions. When Shopify sends a shop-redaction request, we remove the store's relational data and place its unreferenced theme and verification objects into a retryable deletion process that continues until removal is confirmed. You can email us at any time to request deletion or confirmation.

Retention

Theme snapshots, build evidence, billing records, service-email deduplication, and your decisions are retained while the app remains installed so the service and its audit history continue to work. Shopify webhook identifiers are retained for 30 days, embedded-app performance telemetry for 90 days, unlinked scheduled storefront checks for 180 days, and activation telemetry for 365 days. Confirmed object-deletion receipts are retained for 30 days. Per-store request counters contain internal identifiers only and are retained for no more than two days. Post-change checks linked to a build remain with that build. Store-specific data is removed through the shop-redaction process described above.

Saved AI explanations, theme-code reviews and their processing records remain with the recorded review while retained in the app, and are removed when that scan or store is erased. Store-specific daily AI request counts are removed when the store is erased. Anonymous spending totals and request state records, containing no store identifiers, source or generated content, remain to enforce service-wide spending limits.

Deletion from our live systems is separate from backup expiry. Production database recovery is configured to retain point-in-time history for 7 days and create daily snapshots retained for 14 days. These copies may retain data after it has been removed from live systems.

Maintenance requests, their attached reports, replies, proposed scopes, approvals, included work records and private problem reports remain available while retained in your store’s app history, including after the original scan record is removed. They are removed with the store’s relational data during shop redaction. A supported failed attempt can retain a small additional private copy of its original and proposed JSON. That copy, its consent, linked report and private AI responses are removed with the store. Invented regression examples and general guidance that passed privacy review remain shared service tests; anonymous spending and execution records retain no store identity or private code.

Manual exports used to validate a release or recovery procedure are held separately with restricted access during validation. We remove these exports once validation is complete.

Service providers

Data is processed on infrastructure provided by Shopify (installation and theme API), Neon (database), Cloudflare R2 (object storage), Vercel (application hosting), Trigger.dev (background processing), Browserbase (storefront verification), Resend (service email), and Anthropic (optional AI explanations, theme-code reviews and approved theme preparation and independent review). Each provider receives only the data needed for its role in operating the service.

Cookies and sessions

Inside the Shopify admin the app authenticates with Shopify session tokens. We do not use advertising or tracking cookies.

Contact

Questions or requests: support@bracket.tools. If we change this policy we will update this page and the date above.