Last updated 14 October 2026

Latchroom privacy policy

Latchroom (“we”) is a Shopify app that lets merchants limit who can view and buy selected products, collections and pages. Latchroom is operated by Nick Harris, an individual based in Australia. This policy explains what information the app handles when a merchant installs it, and what it doesn’t.

Information we store

• The store’s myshopify domain and the Shopify access credentials Shopify issues on install, so the app can work for the merchant.
• The merchant’s access rules: rule names, what they protect, visitor messages, schedules, customer tag names, and passcodes and secret-link keys in hashed form only. We can’t read a passcode back.
• The merchant’s app settings, such as whether checkout protection is on.
• Short-lived counters of passcode attempts per rule, used to slow down guessing. They contain no shopper identifiers and are deleted within minutes.
• Daily counts per rule of locked page views, unlocks and wrong passcodes, shown to the merchant as analytics. These are totals only: no IP address, customer ID, cookie or cart is recorded with them. They’re kept for up to 400 days.
• Records of privacy requests sent by Shopify (request ID, type and store only), kept for 30 days.

Information we don’t store

Latchroom doesn’t store shopper names, emails, addresses, IP addresses, orders or customer tags. Whether a shopper is signed in or has a required tag is checked by Shopify on the storefront and at checkout. When a shopper unlocks a rule with a passcode or link, the unlock token is kept in that shopper’s Shopify cart, not on our servers. Latchroom doesn’t use tracking cookies, third-party analytics or advertising.

How we use information

Only to run the app: to publish the merchant’s rules to their store, to check passcodes and secret links, to provide support, and to meet Shopify’s requirements. We don’t sell, rent or share information for advertising.

Where information is processed

The app and its database are hosted by Railway (Railway Corporation) in the United States. Shopify processes store and customer data under its own privacy policy. Data is encrypted in transit (HTTPS) and at rest by our hosting provider. We don’t use other subprocessors.

Retention and deletion

When a merchant uninstalls Latchroom, Shopify notifies us and we delete everything we store for that store straight away: credentials, rules, settings, counters and analytics. We do the same again if Shopify later sends a shop redaction request. Shopify removes the app’s storefront and checkout configuration from the store on uninstall. We don’t keep separate backups of this data. Customer data requests and customer redaction requests from Shopify are answered promptly; as we hold no shopper data, there is nothing to export or delete for an individual shopper.

Your rights and contact

Shoppers should contact the merchant whose store they used first. Merchants and shoppers can also contact us at nick@mgdevelopment.com.au with questions or requests about personal information, including access and correction. We handle personal information in line with the Australian Privacy Principles and, where they apply, the GDPR and US state privacy laws. If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority.

Changes

We’ll update this page when the app’s handling of information changes, and change the date at the top.