Privacy policy
Last updated: November 4, 2026
Section Universe (“the app”, “we”, “us”) is a Shopify app made by strm.design. It adds storefront sections to Shopify themes. This policy explains what information the app collects when a merchant installs and uses it, how that information is used, and the choices merchants and their customers have. Questions: hello@strm.design.
Information we collect from merchants
When you install Section Universe, Shopify gives the app access to your store with the permissions you approve:
reading your themes and writing the app’s own section files into them (read_themes, write_themes). The app
stores:
- Your store’s identity: its myshopify.com domain and Shopify ID, and when the app was installed.
- Access to your store: the access token Shopify issues to the app, and, when Shopify includes them, the name and email address of the staff member using the app.
- Your plan: which Section Universe plan your store is on and its status, read from Shopify’s billing system. Payments are handled by Shopify; we never see card or bank details.
- How you use the app: which sections you saved, installed or removed, in which themes, the result of theme compatibility checks, and the app language.
- What you send us: feedback, section suggestions and support emails.
The app does not access your customers, orders or products through Shopify’s Admin API.
Information on your storefront
Sections run on your storefront as part of your theme. They show information that’s already in your store (products, prices, collections) and don’t send your customers’ personal information to us. Some sections keep a little information, or use other services, as follows:
- In the shopper’s own browser: Recently viewed remembers the products a shopper looked at, and the Size guide remembers whether they prefer centimetres or inches. This stays on their device (browser local storage) and is never sent to us.
- Store locator: location addresses without coordinates, and places a shopper types into its search, are sent to the app, looked up with OpenStreetMap’s Nominatim service and cached as place and coordinates, with nothing that identifies the shopper. The map’s tiles load from OpenFreeMap and its code from jsDelivr, which receive the shopper’s IP address like any website they load from. Merchants can make the map wait for the shopper’s consent.
- Shoppable video: clips linked from YouTube, Vimeo or TikTok load from those services, under their own privacy policies, when a shopper plays them. YouTube clips use its privacy-enhanced (no-cookie) domain.
- Product drop sign-up: the email address a shopper enters is saved by Shopify as a customer of your store, with their marketing consent. It goes to your Shopify store, not to us.
- Add to cart goes through your store’s own Shopify cart.
To protect the app from abuse, requests to it are rate-limited using a one-way hash of the visitor’s IP address; the IP address itself isn’t stored, and the hashes are deleted after an hour.
How we use information
Only to run the app: to install and update sections in your themes, to show your plan and apply its features, to answer support requests and improve the app. We don’t sell information, use it for advertising, or share it except with the service providers below.
Service providers
| Provider | What for | Where |
|---|---|---|
| Shopify | App platform, billing | Global |
| Fly.io | Hosting the app and its database | United States |
| Tigris (Fly.io) | Storing catalog images and files | Global |
| OpenStreetMap Nominatim | Finding places on the store locator’s map | Europe |
| Vercel | Hosting this documentation | Global |
Retention and deletion
- When you uninstall the app, its access tokens are deleted immediately. 48 hours later Shopify sends a request to erase your store’s data, and the app deletes everything tied to your store when it arrives.
- Sections you installed stay in your themes as theme files until you remove them (see Privacy and uninstalling).
- Requests Shopify sends on behalf of your customers, to see or erase their data, are answered within 30 days. The app holds no customer data, so they’re recorded and closed.
- Cached store locator places are kept to avoid repeating lookups; they contain no personal information.
Security
Information is sent over HTTPS and stored with our hosting provider in an access-controlled database. Access tokens are used only by the app’s servers, and only people who run the app can reach its administration tools.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete personal information we hold about you, and to object to how we process it. Email hello@strm.design from the address on your store account, and we’ll respond within 30 days. Your store’s customers should contact your store; we act on their requests through Shopify as described above.
Changes
We’ll update this page when the app’s handling of information changes, and change the date at the top.
Contact
strm.design · hello@strm.design