HaloTrack Order Tracking (“HaloTrack”) shows a store’s customers the status of their own orders on the store’s domain (/apps/track).
Data we access: with the read_orders permission, HaloTrack reads an order only when someone looks it up: order number, the order email (used solely to verify that the person asking owns the order), line items, fulfillment and tracking events. The email is compared and discarded; it is never stored, logged or shared.
Data we store: the shop domain, an encrypted access token, your app settings, anonymous daily lookup counts, and a short-lived hashed rate-limit key (shop + IP hashed with a secret, deleted within 24 hours). We store no customer names, emails, addresses or order contents.
Processing runs on Cloudflare Workers and Cloudflare D1. We do not sell data and use no third-party analytics or ads.
Deletion: on uninstall we delete tokens and counters immediately; on Shopify’s shop/redact request we delete everything for the shop. customers/redact and customers/data_request are honored — we hold no customer records, so there is nothing to return or remove.
Contact us at support@addsum.top for any privacy question.
2026-10-31