Cove Wishlist
Privacy policy
Last updated 2026-10-22
Cove Wishlist is a Shopify app that lets a store’s shoppers save products to wishlists. It is published by Stack Craft Digital (“we”). This policy explains what data the app processes, why, where it is stored and for how long. It applies to merchants who install the app and to the shoppers on their stores.
Our role
For shopper data, the merchant is the controller and we are the processor: we handle that data only to provide the app to the merchant, under our terms and data processing addendum. Shoppers who want to exercise their privacy rights should contact the store they shop with; we act on the merchant’s and Shopify’s requests.
What we store
| About | Data |
|---|---|
| Merchants | Store domain, the access token Shopify issues at install, app settings and design choices, plan. |
| Signed-in shoppers | Shopify customer ID, saved product and variant IDs, list names, share links the shopper creates, and when each item was saved or removed. |
| Guest shoppers | A random identifier kept in the browser’s local storage (we store only a one-way hash of it), plus the same wishlist data as above. |
| Wishlist sales | For each order line that came from a wishlist (or was bought by a customer who had saved the product): the Shopify order, line item and product IDs, quantity, amount, currency and order date. No customer ID, name, email or address is kept with it. |
| Shoppers who ask for a “Notify me when available” email | The product variant, the language of the email and, for a signed-in customer, their Shopify customer ID. For a guest: the email address they typed, encrypted, and a keyed one-way hash of it (used to avoid duplicates and to unsubscribe). |
We do not store shoppers’ names, phone numbers, postal addresses or payment details. The only email address we store is one a guest types into “Notify me when available”, and only for that alert: it is encrypted (AES-256-GCM), never shown to the merchant, never exported or used for anything else, and deleted as soon as the alert is sent, when the shopper unsubscribes, after 180 days at most, or when Shopify sends a redaction request. A signed-in customer’s email is read from Shopify at the moment an alert is sent and is not stored. The app sets no cookies and uses no advertising or cross-site tracking.
Orders
To report the sales wishlists bring in, the app reads new orders as Shopify sends them (the read_orders permission, which covers the last 60 days of orders). Shopify sends us only the order’s IDs, date, the customer’s Shopify ID, and each line’s product, quantity, price, discounts and line properties; we ask Shopify to leave everything else out. Products added to cart from a wishlist page carry a hidden line property, _cove, holding a random-looking reference to the list; it contains no customer details. The customer’s Shopify ID is used only at that moment, to check whether they saved the product they bought, and is not stored with the sale.
Wishlist imports
A merchant can upload a file exported from another wishlist app. Email addresses in that file are used only in memory, to match each list to a Shopify customer ID, and are never written to our database. The uploaded file is encrypted while it waits and deleted when the import finishes, or after 24 hours at most.
Why we use it
- To show, save and sync wishlists across devices and sessions.
- To email a shopper the alert they asked for when an item is back in stock. If the merchant turns them on, signed-in customers can also get back-in-stock, price-drop and low-stock emails about items on their wishlist, but only if they subscribed to the store’s email marketing in Shopify. With the same consent, the merchant can also send them an occasional reminder about wishlist items they haven’t bought. Every email has a one-click unsubscribe link; emails carry no tracking pixels or tracked links.
- To tell the merchant’s Shopify Flow when a wishlisted item is back in stock or drops in price. Messages sent from Flow come from the merchant’s own tools, under the merchant’s consent settings.
- To show the merchant totals, such as their most-saved products, in the app and in a weekly or monthly summary email to the store’s own email address, which is read from Shopify when the email is sent and never stored. The summary holds totals and product names only, nothing about any shopper.
- To show the merchant the sales their wishlists bring in (attributed and influenced revenue).
We never sell data or use it for advertising.
Who else processes it
| Subprocessor | Purpose | Location |
|---|---|---|
| Railway Corporation | Application hosting and database | the European Union (Amsterdam, Netherlands) |
| Lettermint B.V. | Sending alert emails (the recipient’s address, the email itself, delivery and bounce status) | the European Union (Netherlands) |
Shopify provides the store data the app reads, under Shopify’s own privacy policy.
How long we keep it
- Items a shopper removes are deleted 90 days after removal.
- Wishlist sales are deleted 400 days after the order. Order IDs kept only to ignore Shopify’s repeated deliveries are deleted after 30 days.
- Wishlists are kept while the app is installed. When a merchant uninstalls, Shopify sends a shop redaction request about 48 hours later and we delete all of that store’s data.
- “Notify me” requests, including a guest’s encrypted email, are deleted when the alert is sent, when the shopper unsubscribes, or after 180 days. With double opt-in, an address that isn’t confirmed is deleted after 7 days. Records of sent alerts keep counts only.
- If an alert email bounces or is marked as spam, we keep a one-way hash of the address (never the address) for a year so we don’t email it again. If a signed-in customer unsubscribes, we keep their customer ID with that choice.
- When Shopify sends a customer redaction request, we delete that customer’s wishlists and alert requests, matched by customer ID and by email address, and the wishlist sales recorded from the orders Shopify names in it. Data requests are answered with the customer’s saved product IDs, pending alerts and the wishlist sales recorded from their orders.
Security
Data is encrypted in transit and at rest, access is limited to the people who run the app and protected by two-factor authentication, and access is logged. See our security page for details and our incident response commitments.
Changes and contact
We will update the date above when this policy changes and tell merchants about material changes in the app. Questions: contact@stackcraftdigital.co.uk, Stack Craft Digital, 66 Paul Street, London, EC2A 4NA, United Kingdom.