Undo History — Privacy Policy

Last updated: 27 August 2026. Maintained alongside the code it describes; see §10 for how changes are announced.

Summary — the short version

Undo History records changes to your own product catalogue so you can undo them. It reads and writes products, and nothing else. It holds no data about your customers at all — not their names, not their emails, not their orders, not their addresses. That is not a promise about how we behave; it is a consequence of the permissions we ask for, which do not include customer data. We never sell data, never use it for advertising, never contact your customers, and share it with no one — we use no third-party sub-processors at all.

Which app this policy covers

Undo History (the Shopify app), built and operated by Edwin Guo (ABN 20 938 499 163), a sole trader in New South Wales, Australia, trading as Sushinet ("we", "us").

One app per policy, so nothing here describes a product you did not install:

Ruleproof (checkout rules) — privacy policy · DPA.
Rules2Tag (automatic tagging) — privacy policy · DPA. That app does process customer data; this one does not. The apps share infrastructure but hold separate databases, separate credentials and separate data.
This website, and our dealings as a studio (analytics, email, LinkedIn) — website privacy policy. Separate because the roles differ: there we are the controller in our own right; here you are the controller and we are your processor.
Undo History's own processor terms — DPA.

1. What we collect, and why

1.1 The tracked-field baseline

One row per product, variant and tracked field, holding that field's current value (TrackedFieldState). This is what a change is measured against — without it the app cannot tell that anything moved, and the first change to every product would be swallowed silently.

Eleven fields are tracked: price, compare-at price, inventory policy and availability (per variant); status, title, description, product type, vendor, handle and tags (per product).

1.2 The change history

One row per detected change (FieldChangeEvent): the field, the old value, the new value, when, and — where a flagging rule matched — the sentence explaining why it was flagged. Also whether it has been undone, and whether it is an undo of an earlier change.

This is the product. It describes your catalogue, not any person.

1.3 Product snapshots

A copy of each product as it last stood (ProductSnapshot): title, description, product type, vendor, tags, status, variants with prices and SKUs, and the URLs of its images. Kept so a product Shopify has permanently deleted can be rebuilt.

⚠️ Image URLs are references, not files. We store the address, never a copy of the picture, and Shopify removes a deleted product's image files — so a restore usually cannot bring photos back. The app says so on the screen where it matters.

This is the fullest copy of your catalogue we hold, which is why it is named explicitly in the erasure list below rather than left to a general clause.

1.4 Your settings, and app bookkeeping

Which flagging rules you have switched on and their thresholds (AlertSettings); catalogue-scan bookkeeping so a crawl can resume where it stopped (ShopScan); your OAuth session token (Session); and billing/promotion state (ShopLedger, PromoRedemption, PendingUpgrade, PromoAttempt, ShopPrompt).

1.5 What we do NOT collect

No customer data of any kind. No names, emails, addresses, phone numbers, orders, carts or checkouts. No payment card data (we never see it). No passwords. No browsing behaviour. No data from stores that have not installed the app.

We do not merely decline to use customer data — it is unreachable to us. Shopify enforces permissions, and we have not asked for any that would grant it (§8). A test in the codebase (test/noPersonalData.spec.ts) fails the build if that ever changes, including the two places an email could quietly appear.

1.6 Your shop domain

Stored on every row, because it is the tenant key and the app cannot be multi-tenant without it. If your shop domain contains your own name, that is personal data about you, the merchant — not about your customers — and it is processed for the sole purpose of serving your installation.

2. Roles

For your customers' data there is no processing to describe, so the usual controller/processor question barely arises. To the extent we process anything on your behalf, you instruct us: installing the app and switching on rules are those instructions. Our Data Processing Agreement binds us to that role, and states plainly that its Annex of personal-data categories is empty.

3. Where data lives

One server (Oracle Cloud, encrypted block storage), one SQLite database for this app, TLS for all transport. The same server hosts our other apps; each runs as a separate system user with a separate database and separate credentials.

No one. Undo History has no third-party sub-processors — no analytics, no error-tracking service, no email provider. Error reporting is deliberately un-wired in this app (app/sentry.server.ts is a no-op stub); if that changes, the DPA commits us to 30 days' notice before any sub-processor can touch your data, and this section will name it.

5. How long we keep data

Baselines, change history, snapshots, settings: for the life of your installation. These ARE the product — a deleted baseline silently stops tracking, and a deleted snapshot means a deleted product can no longer be rebuilt.
⚠️ Your plan's history window LIMITS WHAT IS SHOWN, NOT WHAT IS STORED. On the Free plan, changes older than 30 days stop being listed and stop being undoable. They are not deleted. Saying otherwise would be the easier sentence and it would be false — there is no pruning job in this app, by design, so that upgrading restores your full history rather than finding it gone. If you want older history actually erased, uninstalling erases everything (below), and you may ask us to erase it at any time: support@sushinet.fyi.
On uninstall: Shopify sends shop/redact 48 hours later and we erase the baselines, the change history, the product snapshots, your settings, the scan bookkeeping, the promotion-attempt log and the OAuth session — every table holding your catalogue or your session.
- Four small tables are deliberately kept: billing and promotion state, and whether you have already dismissed our review request. They are keyed by a hash of your shop domain rather than the domain itself, they contain no personal data, and they exist precisely to outlive an uninstall — otherwise a reinstall would hand out a fresh free trial and re-ask a merchant who already said no. A coverage test enumerates every database table and fails if any is neither erased nor explicitly exempted here, so a future table cannot be silently forgotten.
On a customer erasure request (customers/redact): there is nothing to erase, because there is nothing held. We acknowledge the request cleanly, as Shopify requires.
Backups: nightly, encrypted, off-site, with bounded retention. Backups inherit the erasure obligations above.

6. Access

One operator. Server access is by SSH key only; password authentication is disabled. Because this app holds no protected customer data, there is no protected-data access log to maintain — the honest statement is that the controls above are what stand between your catalogue data and anyone else, not an audit trail we do not have.

7. Security, and if it fails

Encryption in transit (TLS everywhere) and at rest (encrypted block storage); key-only server access; separate system users and databases per app; HMAC verification on every webhook before any processing; and permission minimisation as the primary control — the app cannot leak customer data it was never granted access to.

We will notify you within 72 hours of confirming a breach affecting your data, with what was affected, what we did, and what we recommend you do.

8. Permissions and Protected Customer Data

We request exactly two permissions, and they are the whole list:

read_products — to see what changed.
write_products — to undo a change, and to rebuild a deleted product when you ask.

We subscribe to products/update and products/delete (the changes themselves), app/uninstalled and app/scopes_update (lifecycle), app_subscriptions/update (billing), and Shopify's three mandatory compliance webhooks. No webhook we receive carries buyer identity.

We request no Protected Customer Data and have no PCD declaration, because we need none. In the Partner Dashboard the question "Does your app use customer data?" is answered no.

9. Your rights, and your customers'

For your own data (shop domain, settings, catalogue records): write to us and we will provide, correct or erase it. For your customers: there is nothing here to access, correct or erase, and requests arriving through Shopify's customers/data_request and customers/redact webhooks are acknowledged with that answer. We honour these regardless of whether GDPR, the Australian Privacy Principles, or another regime applies to you.

10. Changes and contact

Material changes are announced in the app and take effect no sooner than 14 days after notice. Questions, requests, complaints: support@sushinet.fyi.