Loading page content
How Local Delivery Sheet uses store data
This page describes what the app does with data from your Shopify store, as built today. It adds detail to the HappifyApps privacy policy.
Version 0.1.0 · Reviewed against the app’s code on 2026-10-04
In short
Local Delivery Sheet reads open orders with customer contact details and addresses to build delivery sheets and driver runs. It writes to Shopify only to create or update delivery fulfillments you trigger.
All Happify apps run on one platform and one Postgres database (Supabase), hosted with the apps on Vercel. Store data is kept once per store, not once per app: if you install two Happify apps, they read the same copy of your products, inventory and orders.
Permissions and why
| Shopify permission | Used for |
|---|---|
| read_orders | Import open orders, their delivery attributes and shipping addresses. |
| read_customers | Customer names and contact details on the sheet, through the shared customer import. |
| read_products | Product names for stops and the packing summary. |
| read_locations | Granted with the fulfillment scopes; the app has no location-specific screen. |
| write_fulfillments | Mark orders out for delivery and delivered in Shopify, optionally notifying the customer. |
| read_merchant_managed_fulfillment_orders | Find the fulfillment order to update for a local delivery. |
| write_merchant_managed_fulfillment_orders | Create and update the delivery fulfillment on that order. |
What the app stores
- Orders with their line items and the buyer details listed under “Customer data”
- Saved runs: name, driver name and vehicle, and a snapshot of each stop (customer name, phone, email, address, items and notes)
- Proof of delivery photos and signatures (Pro), stored in our database
- Driver links as a one-way hash, never the link itself
- Your settings and an audit log of runs, dispatches and settings changes
When an app has order access, the import copies each order with its line items, totals, tax lines, discount codes, tags, note, note attributes and Shopify’s risk recommendation. Buyer details are kept only while an app on your store needs them: the buyer’s name, email, phone and shipping and billing addresses only while Local Delivery Sheet or Invoice & Packing Slip is installed, and the customer’s name and email (on the customer record) only while Reorder Predictions, Local Delivery Sheet or Invoice & Packing Slip is installed. Otherwise orders are stored without contact details and customers as a Shopify ID only, and the import does not ask Shopify for those fields. The stored copy of what Shopify sent never keeps the buyer’s contact, browser or device details.
Customer data
The app needs Shopify’s protected customer data approval for name, email, phone and address. They are shown on sheets, in CSV exports and on the driver page.
Changes the app makes in Shopify
- Delivered fulfillments when you mark orders delivered (Advanced)
- Out-for-delivery updates when you dispatch a run with notifications on (Pro)
Who else receives data
| Recipient | Purpose | Data |
|---|---|---|
| Your drivers | Delivering the run | The stops in the run you share: name, phone, email, address, items and notes, until the link expires. |
| Shopify | Customer notifications (Pro) | Shopify sends the out-for-delivery and delivered messages; the app does not email customers itself. |
Hosting is on Vercel and Supabase, listed on our Sub-processors page. We do not sell data or use it for advertising.
Uninstall and privacy webhooks
Shopify sends every app these mandatory webhooks. This is what the app does with each.
| Webhook | What happens |
|---|---|
| app/uninstalled | Marks the app as uninstalled and its subscription as cancelled, and stops syncing for it. Nothing is deleted at this point: Shopify sends the shop redaction request below 48 hours later, and any other Happify app on the store keeps working meanwhile. |
| customers/data_request | Logged on receipt. We prepare the customer’s data by hand and send it to you, the merchant, within 30 days. |
| customers/redact | Removes the customer’s name and email from the customer record; their name, email, phone and addresses from their orders; their contact details from Local Delivery Sheet run stops, along with any proof of delivery photo or signature for those stops; stored webhook records about them; and their email address wherever it was logged as an email recipient. Order lines and totals stay, so your sales history still adds up. |
| shop/redact | Deletes this app’s data for your store: its installation and encrypted access token, subscription record, settings, app-specific data (such as delivery runs and proof of delivery, zones, internal order notes), audit log entries and webhook records. The shared store data (products, inventory, orders, customers) is deleted too when no other Happify app is installed on the store. If one is, the shared data stays for that app, cut down to the customer details it needs. |
Retention
- Run snapshots and proof of delivery are kept with the run while the app is installed. A customer redaction request clears that customer’s name, phone, email and address from their stops and deletes their proof of delivery photos and signatures; the stop keeps its order number and outcome. All runs and proof of delivery are deleted with Local Delivery Sheet’s own shop redaction, 48 hours after uninstall, even if other Happify apps stay installed.
- An expired driver link stops working immediately; the run itself is kept for History.
- This app’s data is deleted when Shopify sends its shop redaction request, 48 hours after the app is uninstalled. Shared store data is deleted then too, unless another Happify app is still installed on the store; in that case it is deleted with the last app’s redaction.
- There is no fixed expiry for synced data while an app is installed; inventory snapshots and order history build up over time because history is what the analysis uses.
- Webhook payloads are emptied as soon as they have been processed; a delivery that failed keeps its payload for troubleshooting. Webhook delivery records are deleted after 30 days.
- Audit log entries are deleted after one year, except saved settings and zone versions, which are kept while the app is installed so you can restore them. Audit entries do not record customers’ email addresses.
- Encrypted database backups are deleted 90 days after they are taken, so data deleted from the live database can remain in a backup for up to 90 days.
Security
- Shopify access tokens are encrypted at rest (AES-256-GCM). Database tables are reachable only from our servers; the browser never talks to the database.
- Inside Shopify admin the app identifies your store from Shopify’s signed session token on every request. It never trusts a store name passed in a URL.
Requests and questions
To ask for a copy of your store’s data, or to have data deleted sooner, use the support form with the topic “Data, privacy or deletion”, or email admin@happifyapps.com. Settings in the app also has a “Download account data” button.