Privacy notice

Effective 5 October 2026

Who operates the app

Tikkivo Countdown Timer is operated by Arturas Gotceitas, Įgulos g. 7-2, Šakių km., Kauno raj., Lietuva. Contact [email protected] about personal data or this notice.

Merchant information we process

We store Shopify authentication sessions: store domain, session identifiers and state, access scopes, access and refresh tokens and expiry details where supplied. Session records may also contain Shopify staff user ID, name, email, locale and account/role verification flags supplied during authentication. We use this information to authenticate authorized merchants and connect to Shopify.

We store campaign IDs, store domain, campaign settings and copy, pause status, revision numbers and creation/update timestamps in our app database. Published campaign settings are also written to an app-owned Shopify metafield so the theme can render them. Do not put confidential information in storefront campaign copy. Product and collection IDs are used for targeting; they are not customer records.

If you email support, we process your message, contact information and any diagnostic details you choose to provide. Hosting and platform providers may process connection information, such as IP addresses, request metadata and operational logs, to deliver and protect their services.

Storefront visitors and browser storage

The app does not collect customer profiles, orders or payment information. Optional timer analytics records daily aggregate views, clicks, dismissals and completions when the merchant enables collection and publishes it. These events contain a timer ID and event name, without shopper identifiers, page URLs or stored IP addresses. Reports cover up to 90 days; older counts are removed when new events are recorded. Uninstall and shop redaction remove the store’s aggregate records. Analytics requests go through Shopify’s app proxy; with analytics off, the storefront timer does not request our app server. Email countdown images use a public capability URL and update when loaded; email services may cache them. There are no advertising trackers. Shopify’s storefront and other installed apps have their own data practices.

An evergreen timer writes a campaign-specific deadline to localStorage (key beginning swift-timer:). It remains in that browser until the visitor or browser clears it; it is not sent to us. A dismissed bar uses sessionStorage (key beginning swift-timer-dismiss:) for the tab session, with an in-memory fallback if session storage is blocked. These existing technical key names remain for compatibility. Browser storage does not synchronize across devices.

Purposes, roles and legal bases

For merchant account/service administration and support, the operator acts as controller. We rely on performance of the service agreement where applicable, legitimate interests in securing and maintaining the service and responding to business contacts, and legal obligations where required. Contact us for information about these interests or to object where applicable.

The merchant determines the purposes of campaigns and storefront storage and is responsible for the relevant visitor privacy notice and any consent or other legal requirements. The app does not provide a consent management system or determine whether an exemption applies. Its local browser storage should be assessed in the context of the merchant’s actual use. Contact us before sending personal data for processing outside the app’s described scope.

Providers and international processing

The service uses Shopify APIs and storefront infrastructure, Heroku application hosting and PostgreSQL database hosting, and the email service used for support. The application dyno is configured in Heroku’s EU region. This does not mean all data is processed exclusively in the EU: provider infrastructure, support and subprocessors may operate elsewhere. Any applicable international transfer requirements must be addressed through the relevant provider arrangements and safeguards. Contact us for further information. We do not sell personal data.

Retention, removal and security

Campaigns are retained while needed to operate the installed app; deleting a campaign removes its app database record and published configuration. On receipt of Shopify’s authenticated app-uninstalled webhook or shop-redaction webhook, the app deletes that shop’s session and campaign records from its database. Customer data request and deletion webhooks are acknowledged because the app has no customer records to export or erase. Webhook payloads are not stored by these handlers.

Uninstalling cannot clear data already stored in visitors’ browsers. Browser storage remains subject to the browser’s lifecycle and clearing controls. Provider backups, operational records and support correspondence may have separate retention periods; we do not promise immediate removal from every backup. We retain support correspondence only as needed to handle the request and applicable obligations; ask us about a specific record.

The app uses Shopify authentication, authenticated webhook verification and store-scoped database operations. Access to credentials and service administration is restricted. No system can guarantee absolute security.

Your rights and contact

Depending on applicable law, you may request access, correction, erasure, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it. Email [email protected]; we may need proportionate information to verify your request. Storefront customers should contact the merchant about the merchant’s processing. You may complain to your local supervisory authority, including Lithuania’s State Data Protection Inspectorate (VDAI).

Changes

We will update this page when our practices change and provide additional notice when required. The effective date identifies the current version.