StepMilo.Privacy policy
Updated October 22, 2026. Operated by Henry Scott.
What we process
We process the shop identifier, encrypted administrator session tokens, merchant-authored guides, translations, shared notes, appearance settings, publication history, and subscription facts needed to operate the service.
What we do not collect
The storefront block does not collect customer names, email addresses, orders, personal completion progress, reading events or browsing history. It does not set tracking cookies or use advertising, analytics, AI, translation, messaging or other third-party business APIs.
Public content
Published instructions and store paths are public and may be present in page source. Drafts stay behind authenticated administration. Never include confidential information in published guides.
Storage and deletion
Connected installations use the app database and Shopify app-owned metafields. Session tokens are encrypted at rest. This implementation immediately deletes active sessions and locally stored content, publication history and billing facts when a verified uninstall event is processed. A temporary deletion tombstone prevents stale requests from recreating deleted data and expires within 35 days. Completed webhook identifiers are retained for at most 30 days without customer payloads. A verified shop deletion request removes shop data earlier where applicable. Operator backups must follow the documented expiry and deletion procedure.
Official privacy events
Shopify privacy and uninstall webhooks are signature-verified and processed idempotently. Because no customer records are held, customer access and deletion requests are acknowledged without retaining customer payloads.