Last updated: September 19, 2026
SyncNest ("the App", "we", "our", "us"), published by AppNest Studios, is a Shopify app that syncs a merchant's Shopify data (orders, products, inventory, customers, refunds) to and from the merchant's own Google Sheets in real time. This policy explains what data the App accesses, why, how long we keep it, and who it is shared with.
Contact / Data Protection: [email protected]
The App acts as a data processor on behalf of the installing merchant (the data controller). We process the merchant's Shopify store data solely to provide the sync service the merchant configured.
We request the minimum scopes needed for the syncs the merchant enables:
| Scope | Why |
|---|---|
read_orders, write_orders | Sync orders to a sheet; optional write-back of order tags & notes |
read/write_merchant_managed_fulfillment_orders | Optional write-back of tracking numbers / fulfilling orders from the sheet |
read_products, write_products | Sync products; optional write-back of product edits |
read_inventory, write_inventory | Sync inventory; optional write-back of quantities |
read_locations | Resolve inventory location names |
read_customers | Sync customers (only if the merchant enables a customer sync) |
Order and customer records may contain personal data (names, email addresses, shipping/billing addresses) when the merchant chooses to map those columns. That data flows from Shopify to the merchant's own Google Sheet. We do not retain the field values — see §4.
We request only:
.../auth/spreadsheets — read/write the sheets used for syncing..../auth/drive.file — create sheets we make for you and access only files you explicitly pick. We cannot see any other files in your Google Drive.SyncNest's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
| Data | Stored? | Notes |
|---|---|---|
| Shopify session / access token | Yes | Required to call the Admin API |
| Google refresh token | Yes | Encrypted at rest (AES-256-GCM) |
| Google account email | Yes | Shown so you know which account is connected |
| Sync configuration (resource, direction, column mapping, sheet id/tab) | Yes | Your settings |
| Alert email / Slack webhook URL | Yes | Where to notify you on failure |
| Row index (record ID + row number + value hash) | Yes | Keeps syncs idempotent |
| Job/run history, usage counts, audit actions | Yes | Operational metadata |
| Order / product / customer field values | No | Written to your Google Sheet; not persisted by us |
The row-index hash is a one-way fingerprint used to detect changes and keep syncs idempotent — it does not store or reveal the underlying values.
shop/redact compliance webhook, we delete all data for that shop.customers/redact and customers/data_request compliance webhooks. Because we do not store customer field values, redaction primarily concerns the merchant-owned sheet, which the merchant controls.| Provider | Purpose | Data shared |
|---|---|---|
| Google (Sheets & Drive API) | The sync target | The data you configure to sync |
| Hosting (Railway) + Postgres/Redis | Run the App | Stored data listed in §3 |
| Resend | Failure-alert emails (if configured) | Your alert email + error summary |
| Slack | Failure-alert messages (if configured) | Your webhook + error summary |
| Sentry | Error tracking (if configured) | Diagnostic error data |
We do not sell personal data or use it for advertising.
Merchants can export or delete their data by uninstalling the App (triggers full deletion) or by contacting us at the address above. Data subjects should contact the merchant (controller) for GDPR/CCPA requests; we assist the merchant in fulfilling them.
We will update this policy as the App evolves and revise the "Last updated" date above.
SyncNest by AppNest Studios · [email protected]