Privacy policy

Flip to Win ("we") is a Shopify app that runs a gift-reveal game between a merchant's ad and their product page. This policy explains exactly what the app stores, why, and how to get it removed. It covers the app itself and this website.

The short version

• The game page sets no cookies and asks shoppers for nothing: no email, no name.
• We store a random session token per game so gifts can be granted; it identifies a play, not a person.
• We read order totals to report whether the game paid for itself. We do not store customer names, emails or addresses.
• We do not sell data, and we do not use it to train anything.

Data we store about merchants

When a merchant installs the app, Shopify gives us an access token plus the account details of the person installing (name, email, locale) so the app can authenticate. We also store the shop's domain, plan, and the campaigns and settings that the merchant creates. This is kept for as long as the app is installed.

Data we store about shoppers

When a shopper opens a game board, we create a game session with a randomly generated token, a timestamp, and a bot score derived from the request headers. As they play we record which cards were flipped and which gifts were granted. The token then travels in the cart so the gifts can be applied at checkout.

None of this includes a name, email address, phone number or postal address. Shopify strips cookies from app-proxy requests, so the game page cannot set or read one even if we wanted to. We do not fingerprint devices and we do not track shoppers across sites.

Order data

With the merchant's authorisation we read orders that carry one of our session tokens, and store the order's identifier, its subtotal, and the value of the gifts granted. This is what produces the "revenue from players against gift cost" figure in the merchant's dashboard. We request the minimum fields needed for that calculation and never store customer contact or payment details.

Bot filtering

We score each request for bot signals so that automated traffic never counts toward a merchant's impression allowance. The score is derived from the request itself and is stored as a number on the game session.

How long we keep things

Game sessions, funnel events and usage counters are retained while the app is installed so that historical analytics keep working. When a merchant uninstalls, Shopify sends us a redaction request and we erase that shop's data (campaigns, sessions, events, usage and attribution) within 30 days. Shopify also forwards individual customer data requests and redaction requests, which we handle within the same window.

Who else sees it

The app runs on our own infrastructure. Data is processed by our hosting provider and by Shopify itself, which is where billing and authentication live. We do not share data with advertisers, data brokers or analytics networks.

This website

fliptowin.app is a static site. It sets no cookies, runs no advertising pixels, and the playable demo runs entirely in the browser, so nothing you flip here is sent to a server. Fonts are loaded from Google Fonts, which receives your IP address as part of that request.

Your rights

Merchants can request a copy or deletion of their data at any time by emailing us. Shoppers should contact the store they bought from, because under GDPR the merchant is the data controller and we act as their processor. The request will reach us through Shopify's official channel.

Contact

Questions, requests, or a mistake you spotted in this policy: support@fliptowin.app.