Privacy policy

Last updated: October 8, 2026

Gratis is a Shopify app operated by leoworks (“we”). This policy explains what Gratis reads, stores and shares when a merchant installs it, and how that data is protected and deleted. It applies to the Gratis app and this website.

Summary

  • Gratis doesn't read or store customer records — no names, emails, phone numbers, addresses or orders.
  • Gratis stores the free-gift rules you create and an anonymous count of gifts added to carts.
  • We don't sell or rent data, and we don't use it for advertising.
  • Everything stored for a store is deleted when Shopify asks us to after the app is uninstalled.

Data we read from your store

  • Products and collections you pick as gifts or conditions (titles, variant and collection IDs).
  • Discounts: Gratis creates one automatic discount per rule and updates it when the rule changes.

Data we store

  • Rules: name, thresholds, gift variant, conditions, status and the ID of the discount they create.
  • Gift events: when a gift is added to a cart on your storefront, we record your store, the rule and the gift variant with a timestamp. No cart contents, no customer identifiers. This count drives the Free plan allowance and the Flow trigger.
  • Plan: which plan your store is on, read from Shopify.
  • Access token issued by Shopify so the app can act on your store.

Data on your storefront

The Gratis theme embed runs in your shoppers' browsers. It reads the cart through Shopify's Cart API to decide whether a gift applies, and remembers in the browser session whether a shopper removed a gift so it isn't added again. It doesn't set tracking cookies and doesn't send cart contents to us.

Sharing

We use Cloudflare to host the app and its database. We don't share store or shopper data with anyone else, and we don't sell it.

Retention and deletion

  • Uninstalling the app revokes its access token.
  • 48 hours after uninstall Shopify sends a deletion request and we delete all rules, gift events and tokens for the store.
  • Customer data requests and customer deletion requests from Shopify need no action because we hold no customer data.

Security

Data is stored encrypted at rest and transferred over HTTPS. Access tokens are never shown in the app or logs.

Contact

Questions about this policy: leodev19lee@gmail.com.