Privacy Policy

Last updated: September 28, 2026 · Applies to the Shopify app “njX Promo & Price Watch” by njX

Who we are

njX Promo & Price Watch is operated by njX, an independent developer. Contact: [email protected].

What the app does

It keeps a snapshot of your products’ prices and of your discounts, compares every change against it, and sends you an alert or a daily digest in Telegram, Slack, Discord or by e-mail. Access is read-only: the app cannot change prices, discounts, products or anything else in your store.

Data we read and store

• Products and variants: title, SKU, price, compare-at price, cost per item, product status and whether the product is published to the online store. Every active product is watched, whatever channel sells it; gift cards are not.
• Discounts: title, type, value, what it applies to, start and end dates, minimum requirement, usage limit, how many times a code has been used and the sales total Shopify counts for it, which discounts it can combine with.
• Our own records: the history of changes we saw, the problems we opened and how they were closed, how often each running code was used (to spot a leak), and the values of a discount you confirmed as your plan.
• Settings and channels: your thresholds and the hour of the digest; the e-mail addresses, Slack and Discord webhook URLs and Telegram chat ids you add, and, when you connect Slack with “Add to Slack”, the token of our bot in your workspace and the names of its channels (addresses, URLs, chat ids and tokens are stored encrypted; addresses and URLs are shown masked). The Slack bot can post messages and list channel names; it cannot read messages.
• Logs: which alert went where and when, and messages you send through the support form.

From orders we read the lines only, never the buyer. The app requests three read-only permissions: read_products, read_discounts and read_orders. A paid order is cut, before it is even queued, to its lines (product, quantity, price) and to what each discount took off, so Results can say what a promo brought. Names, e-mail addresses, phone numbers, addresses and notes of your customers never reach our servers and are never stored; we request no customer fields from Shopify. Orders placed before the app was installed are not read. Results are kept for 90 days. Shopify’s mandatory customer-data and customer-redaction requests are answered automatically: we hold no customer data to return or delete.

How your numbers are used

• Your shop’s prices and discounts are used for your shop only: to spot what looks wrong and to build your alerts, digest and cleanup reports.
• They are never sold or shared, and never used to train machine-learning or AI models, or to feed any kind of market or competitor analysis. We do not compare your prices with anyone else’s.
• We keep a small amount of anonymous operational telemetry — how long a webhook took to process, how many alerts were sent, which rule fired — identified by shop domain and used to keep the app healthy.

Where data is processed

• Cloudflare (Workers, D1, Queues) runs the app and stores its database. E-mail is sent through Cloudflare Email Service; a backup provider (Resend) may deliver a message when the first one is unavailable.
• Telegram (Telegram FZ-LLC), Slack (Slack Technologies, LLC, a Salesforce company) and Discord (Discord Inc.) deliver messages to the chats and channels you connect. Delivered messages live there under their own privacy policies.
• Shopify handles billing; we never see payment details.

Retention

• History of changes: 90 days (the Free plan shows the last 7 days of it). Use counts of discount codes: 7 days. Closed problems: 90 days. Delivery logs: 90 days. Processed-webhook ids: 7 days. Promo results (the lines of paid orders that had a promo): 90 days. Messages sent through the support form, with the address for our reply: 12 months.
• The snapshot of prices and discounts is kept while the app is installed, because it is what every comparison is made against. The plan you confirmed for a discount is kept until you remove it or the discount is deleted.
• When you uninstall the app, or when Shopify sends a shop/redact request, all data for your store is deleted.

Channels and recipients

An e-mail address receives nothing until its owner clicks the confirmation link, and every message carries a one-click unsubscribe. A confirmation link is bound to the exact recipient it was issued for and only works while that recipient is still waiting to be confirmed, so an old link cannot re-subscribe someone who opted out. Anyone in a connected chat or channel can see the alerts, which contain product names, prices and discount names — connect a channel your team should see.

Security

All traffic is encrypted in transit (TLS). Stored data and its backups are encrypted at rest by Cloudflare (D1); e-mail addresses, webhook URLs and chat ids are additionally encrypted with a separate key (AES-256-GCM) and shown masked in the app. Provider error messages are stripped of the recipient’s address before they are logged. Links in e-mails are signed and expire. Shopify webhooks are verified by signature, and requests from our Telegram bot are checked against a secret token. Only the operator has access to production; the Cloudflare, GitHub and Shopify Partner accounts require strong passwords and two-factor authentication.

Incident response

• Detection. Errors, failed deliveries, stuck alerts and health checks are monitored around the clock by an internal alerting bot.
• Containment. On a suspected breach we revoke the affected access tokens, rotate secrets and, if needed, pause deliveries until the cause is fixed.
• Notification. Affected merchants are notified by e-mail within 72 hours of confirming an incident; Shopify is informed through the Partner channels.
• Review. Every incident ends with a written post-mortem and a change that prevents the same failure.

What the app cannot tell you

Shopify tells apps what changed and when, never who changed it. We do not know which member of your staff edited a price, and we never imply that we do.

Contact

Questions or GDPR requests: [email protected], or the support form.