Privacy policy

1. Who we are

Barlio: Announcement Bar (“Barlio”, “we”, “us”) is operated by the Barlio team. It is a Shopify app that lets a merchant create and publish announcement bars on their own storefront.

Questions about this policy, or any request about data, can be sent to barlio.support@gmail.com.

2. Who this policy covers

Two groups of people, with very different answers.

Merchants and their staff, who install Barlio and use it inside the Shopify admin. Barlio holds data about their store, listed in section 4.

Shoppers, who visit a store that is running a Barlio bar. Section 5 is about them, and it is short because of what is in it: Barlio does not collect personal data about shoppers at all.

3. What Barlio asks Shopify for

One access scope: write_app_proxy. It exists so that the analytics endpoint can be served from the store’s own domain rather than from a third-party origin. Barlio requests no scope for products, orders, customers, discounts, files, themes or any other resource, so it has no way to read them.

Alongside that, and within what any installed app may read, Barlio:

• reads four facts about the store — its name, its IANA time zone, its currency and its enabled presentment currencies — so that schedules read in the merchant’s own clock and a free-shipping threshold defaults to a sensible amount. These are cached on the store record so they are not re-fetched on every screen;
• writes one metafield on the store, in the app’s own reserved namespace, holding the compiled announcement configuration that the storefront renders;
• reads which plan the store is subscribed to, through Shopify’s Admin and Partner APIs.

4. What Barlio stores about a store

This is the complete list of what the database holds. Every record is keyed to the store’s myshopify domain, and every query Barlio makes is filtered by it, so one store’s data cannot be returned to another.

The periods above are enforced by sweeps that run on ordinary traffic rather than on a clock, so a store with very little traffic can hold a row past its window. shop/redact erases announcements, analytics, sessions and the store record in one transaction; the only thing left is the delivery id of the webhook itself, kept so that a retry cannot re-run the erasure.

Barlio also writes an application log: one line per event, holding a request id, the store domain, the route or action, a publication revision and an error type. Access tokens are never logged, and values under keys that look like a credential are redacted before the line is written.

5. What happens on a storefront

The bar a shopper sees is rendered from a Shopify metafield that the theme already has. The storefront makes no request to Barlio to decide what to show, so nothing we serve stands between a shopper and the page. A bar that is displayed does send us one thing, described below.

Which bar is eligible is decided in the shopper’s own browser. The page type, the path and the country come from Shopify’s request context, are compared against the merchant’s targeting rules locally, and are never sent to Barlio. Free-shipping progress reads the cart total from the store’s own cart, in the browser, for the same reason.

Dismissing a bar stores one key in the browser’s localStorage, on the merchant’s own domain, holding an expiry timestamp so the same bar is not shown again for 90 days. It is not a cookie, it is not readable by any other site, and it is never transmitted anywhere.

The one message a bar sends

When a bar is actually displayed, and when its button is clicked, Barlio sends a small beacon to the store’s own domain at /apps/barlio/event, through Shopify’s app proxy. The entire body looks like this:

{"events":[{"id":"k3f9a1c2-1","announcementId":"…","type":"impression"}]}

The id is a random string generated fresh for each page load, paired with a counter. It exists for one purpose — so that a retried delivery of the same event is not counted twice — it is discarded after 30 minutes, and it is not linked to a person, a session or a device. Nothing else is sent: no shopper identifier, no cart contents, no page URL, no account details. An impression is counted at most once per announcement per page load, and previews inside the theme editor are not counted at all.

Because the beacon travels through Shopify’s app proxy, Shopify signs the request and appends its own parameters to it, which include a logged-in customer id when the shopper happens to be signed in to that store. Barlio does not read, use or store those parameters, and none of them is written to the database. Server access logs at the hosting layer record request lines, so they contain whatever was in the URL; those logs are operational, are kept only as long as the hosting platform retains them, and are never joined to anything else or used to build a profile.

Barlio sets no cookie on a storefront and loads no font, no framework, no tag manager and no third-party script. If analytics ingestion fails or is blocked, the bar behaves exactly the same.

6. Cookies

None on a storefront, and none for advertising or analytics anywhere. While a merchant is installing or signing in to the app, the official Shopify library may set short-lived cookies on Barlio’s own domain to complete the OAuth handshake. Barlio implements no authentication of its own — no password, no session cookie format of its own — and relies entirely on Shopify’s.

7. Who else sees the data

• Shopify. The platform the app runs on. Data flows to Shopify when a merchant publishes — the compiled announcement configuration is written to a metafield on their own store — and when Barlio verifies which plan a store is on. Shopify’s own handling of that data is governed by Shopify’s privacy policy.
• Our hosting provider. The application server and its database run at Fly.io, in the iad region (Ashburn, Virginia, United States).

Nobody else. Barlio does not sell personal information, does not share it for advertising, does not use it to train models, and has no third-party analytics, advertising or error-tracking service embedded in either the admin app or the storefront script.

8. Payments

Billing is handled entirely by Shopify. Barlio never sees, receives or stores a card number, a billing address or an invoice. It reads only which plan is currently active on a store and whether a free trial is running.

9. Shopify’s mandatory privacy webhooks

Shopify requires every public app to answer three privacy webhooks. Here is exactly what Barlio does with each.

10. Uninstalling, and deletion

When a merchant uninstalls Barlio, the stored session and its access token are deleted immediately — the token is dead the moment the app is removed, and keeping it would be a liability.

The merchant’s announcements are deliberately not deleted at that moment. Uninstalling and reinstalling within a day or two is common, and losing the work in between would be worse than holding it briefly. Shopify sends the shop/redact webhook roughly 48 hours after uninstall, and that is where everything is erased: announcements, analytics rows, sessions and the store record.

A merchant who wants their data erased sooner can email barlio.support@gmail.com from the store, and it will be deleted.

11. Your rights

Shoppers. Barlio holds no personal data about shoppers, so a request to access, correct, delete or opt out has nothing to act on. Barlio does not sell or share personal information as the GDPR, the CCPA and comparable laws use those terms, and it does no profiling or automated decision-making.

Merchants. Barlio processes store data to provide the app, on the merchant’s instructions, for as long as the app is installed. A merchant may ask for a copy of what is held, ask for it to be corrected, or ask for it to be deleted, by emailing barlio.support@gmail.com from the store. Identity is verified through the store, because the store is the only identifier Barlio has.

12. Security

• Authentication is Shopify’s OAuth. Barlio stores no password and issues no credential of its own.
• Every database query is scoped to one store’s domain, taken from the verified Shopify session and never from a URL, form field or header.
• Every webhook is signature-verified by Shopify’s library before any Barlio code runs, and every analytics request through the app proxy is signature-verified in the same way. An unsigned request is refused and nothing is recorded.
• Announcement copy is treated as text everywhere it is rendered, so merchant-authored content cannot execute as code in a shopper’s browser.
• Secrets are read from the server environment only. Access tokens are never logged, and credential-shaped values are redacted before a log line is written.

To report a security issue, email barlio.support@gmail.com with “security” in the subject, including the store domain and enough detail to reproduce.

13. Changes to this policy

If what Barlio stores or sends changes, this page changes with it and the effective date above is updated. Where a change materially affects merchants, it will also be communicated in the app.

14. Contact

the Barlio team
barlio.support@gmail.com