Privacy policy — Steady: Sales Countdown Timer
Last updated: 19 October 2026
What this app is
Steady: Sales Countdown Timer (formerly Steady Countdown) adds a countdown timer to a Shopify storefront. It is installed by a merchant on their own store.
What it stores
About your store
In this app’s own database, two records per shop. One is the session record, holding:
- Your shop’s domain, and an access token that lets the app read and write its own data through Shopify’s Admin API.
- A refresh token and its expiry, because the app uses expiring access tokens rather than permanent ones.
- The scopes you granted, and the session’s own identifier.
The session table also carries columns for a staff user’s name, email, locale and account role. They belong to Shopify’s standard session schema and are filled in only for online sessions. This app requests offline access exclusively, so nothing is ever written to them.
The other is a review-prompt record: your shop’s domain, when the app first saw it, when it last asked you for a review, the answer code Shopify returned to that ask (for example, shown or already reviewed), how many times it has asked in the past year, and whether Shopify told us you had already reviewed. It exists so the app does not ask the same merchant twice. It holds no personal data and nothing about a shopper.
Your shop’s timezone is not stored. It is read from Shopify each time a page loads, and used to show times as you would write them.
The countdowns you create — heading, end time, end behaviour, end message, and whether they are published — are stored in Shopify as app-owned metaobjects on your own shop, not in this app’s database.
Two settings in your store, attached to the app’s installation. One says whether your plan is the paid one, so the storewide bar can stay in view. The other names the first countdown you created, so a Countdown block with no countdown chosen shows that one; once you delete any countdown it is switched off, and such a block shows nothing. Your theme reads both. They hold no shopper data.
In server logs
When Shopify sends the app a webhook, the app writes one line to its hosting provider’s log stream recording the shop domain and which webhook it was. Nothing about a shopper appears in those logs, and no request from a storefront reaches them, because storefronts never contact this app at all.
About your customers
Nothing.
This is a consequence of how the app is built rather than a policy choice. A countdown is rendered into your page by Shopify from data already on your shop. A shopper’s browser never contacts this app, so there is nothing for it to learn about them: no identifiers, no page views, no behaviour, no cookies set by this app.
What it does not do
- It does not track, profile, or identify shoppers.
- It does not set cookies on your storefront.
- It does not send data to any third party.
- It does not sell or share data with anyone.
- It does not add scripts to your storefront that call out to other services.
- It does not use third-party cookies or browser storage to identify you. The app’s admin screens run inside the Shopify admin and authenticate with the session token Shopify provides on each request.
Who else sees the data
Only Shopify, which hosts your store; Railway, which hosts the app’s server and the database holding the two records above; and Cloudflare (cloudflare.com), which stores encrypted backups of the app’s database in its R2 storage in Eastern North America. Each backup is encrypted with our key before it leaves Railway; Cloudflare cannot read it. No analytics service, advertising network, or other processor receives anything.
Where it is processed
The app is operated by an individual developer in the Republic of Korea. Its server, its database and its logs run on Railway in the Netherlands — that is, inside the European Economic Area and outside the United Kingdom. Your countdowns themselves stay on Shopify’s infrastructure, wherever Shopify holds your store’s data.
Payment
Charges are made through Shopify’s billing system and appear on your Shopify invoice. This app never receives, handles or stores your card or bank details.
Access requested
The app asks for permission to manage its own metaobjects (write_metaobjects, write_metaobject_definitions) and nothing else. It has no access to your products, orders, customers, or payments.
Retention and deletion
Both records for your shop are kept for as long as the app is installed, and no longer — apart from the encrypted backups described below, which expire within 30 days. Countdowns live on your shop, and stay under your control for as long as the app is installed.
Uninstalling deletes both of them — the session and the review-prompt record. Shopify also sends a shop erasure request 48 hours after uninstall, and the app deletes anything still keyed to your shop when it arrives.
Backups: an encrypted copy of the database is made every day and kept for 7 days, and every week and kept for 28 days. Data that is deleted — including after a shop/redact or customers/redact request — is gone from the backups within 30 days. Backups are used only to restore the service after a failure.
The app answers Shopify’s two customer data requests — a request to view a customer’s data, and a request to erase one — by confirming that it holds no data about that customer, because it never did.
Your rights
Because the app stores no personal data about shoppers, there is nothing to request, correct or erase on their behalf.
For your own store’s data, write to the address below and say what you want: a copy of everything held about your shop, a correction, or erasure. Requests are answered within 30 days. Erasure is also automatic and needs no request — uninstalling triggers it. There is no account to close and no separate login to cancel.
Changes
If this policy changes, the date at the top changes with it.