Home
›Linkfront Privacy Policy
Linkfront Privacy Policy
Linkfront: Link in Bio Shop (“Linkfront”, “the app”) is a Shopify app published by Progryss
Media Private Limited (“we”, “us”). It lets a merchant build a shoppable link-in-bio page
that is served on their own store domain.
This policy explains what the app stores, why, and for how long.
1. What we collect
Merchant and store data. Your `.myshopify.com` domain, your store’s display name,
primary domain and currency, and an access token issued by Shopify when you install the app.
Page content you create. The headline, bio line, colours, button shape, page title and
URL, search-engine title and description, and whether each page is published.
Links you add. Shopify product and collection identifiers, any label you type to override
a product’s name, custom link labels and URLs, and social profile URLs or an email address
you choose to display.
Profile image. Any avatar you upload is stored in **your own Shopify Files library**, not
on our servers. We keep only the resulting Shopify CDN URL.
Cached store data. Product and collection titles, images, prices and availability are
fetched from Shopify and cached for five minutes so a busy page does not repeatedly call the
Shopify API. This is a performance cache, not a record: it is refreshed continuously and
deleted with everything else when you uninstall.
Plan status. The date through which a paid plan gives you access, and the app proxy path
your store is served from.
No shopper or customer data. This is the important one. A link stores a *product
identifier*, never a person. The app does not collect, request or receive names, email
addresses, phone numbers, addresses, orders or payment details of your customers, and it
requests **no Shopify Protected Customer Data** scopes at all.
No tracking of page visitors. The public bio page sets no cookies, loads no analytics,
and contains no tracking pixels or third-party scripts. The only JavaScript it ships is a
short script that scrolls the product carousel.
Server logs. Like any web service, our servers and web server keep short-lived
operational logs — IP address, request path, timestamp, user agent — used only to diagnose
faults and defend against abuse. Application logs record your store domain against errors so
we can help you; access tokens, secrets and authorisation headers are redacted before
anything is written.
We do not sell data, share it for advertising, or use it to build profiles.
2. How we use it
To render your bio page on your store’s domain, keep product information current, save your
settings, apply your plan’s entitlements, operate billing through Shopify, respond to your
support requests, and keep the service secure and legally compliant. Nothing else.
3. Sharing and sub-processors
– Shopify — the platform. We read your product and collection data through Shopify’s
Admin API, upload avatars to your Shopify Files library, and Shopify processes all billing.
– DigitalOcean — hosting. The application and its database run on a DigitalOcean server.
We disclose data otherwise only where legally required, or to protect the safety, rights or
security of our users and our service.
4. Retention and deletion
While the app is installed, your pages, links and settings are kept so the app works.
When you uninstall, the app receives Shopify’s `app/uninstalled` webhook and immediately
deletes every bio page, every link, your settings and your cached product data, along with
the stored session and access token.
As a backstop, Shopify sends a `shop/redact` request roughly 48 hours after uninstall, and
the app deletes the same data again in case the first delivery never arrived.
Deletion is permanent — there is no archive and no soft delete. **If you plan to reinstall,
export or note anything you want to keep first.**
Server and web server logs are short-lived and rotate automatically.
5. Shopify compliance webhooks
The app implements all three of Shopify’s mandatory privacy webhooks:
`customers/data_request`, `customers/redact` and `shop/redact`. Because the app holds no
customer personal data, the two customer topics have nothing to return or erase; `shop/redact`
performs the deletion described above. Every webhook request is verified by HMAC signature
before it is acted upon.
6. Security and international transfers
Traffic between your browser, Shopify and our servers is encrypted with TLS. Access tokens
and secrets are never written to logs. The database is not reachable from the public internet.
Access to production systems is limited to personnel who need it.
Our servers may be located outside your country. Where required, transfers rely on
appropriate safeguards such as the European Commission’s standard contractual clauses.
7. Your rights
Depending on where you live, you may have rights to access, correct, export or delete your
data, and to object to or restrict certain processing — including under the GDPR and the
CCPA/CPRA. You can exercise most of these directly: edit your content in the app at any time,
or uninstall to erase it.
For anything else, contact us at the address below and we will respond within the period the
applicable law requires.
If you are a **shopper** who visited a merchant’s bio page: we hold no personal data about
you. Any question about your order or personal information should go to the store itself,
which is the data controller for its own customers.
8. Changes to this policy
If we change what we collect or who processes it, we will update this page and revise the
date at the top. Material changes affecting merchants will also be communicated in the app or
by email.
9. Contact
Progryss Media Private Limited
Email: progryss@gmail.com
Sector 63, Noida, Uttar Pradesh 201301,
India