OrderPeekOrderPeek Privacy Policy
Last updated: 24 October 2026
In one sentence: OrderPeek reads your customers' orders from Shopify straight into your own browser, and we never see them.
Who we are
Sudarshan Hosalli (sole proprietor), Kusnoor, GB Jnanaganga, Kalaburagi Reshmi College, Kalaburagi, Karnataka 585106, India, sudarshanhosalli90956@gmail.com. Contact us at sudarshanhosalli90956@gmail.com for any privacy question.
What OrderPeek does
OrderPeek is a Shopify app that works inside your Shopify admin. It lists recent orders that look late or stuck, finds a customer's order by email, name or order number, and shows its delivery status and tracking, with reply templates. An optional Chrome extension shows the same details in a side panel next to emails in Gmail.
Data we handle, and where it goes
| Data | Where it lives | Do we receive it? |
|---|---|---|
| Customer and order data (names, emails, shipping addresses, order contents, tracking) | Admin page: fetched by your browser from Shopify, as the staff member who is signed in, and shown on screen; it exists only in the page's memory while the page is open. Gmail add-on: fetched directly from Shopify to your browser and held in memory (chrome.storage.session) for up to 5 minutes, then discarded; also cleared when you close the browser. |
No. It never passes through our server and we never store it. |
| Email content from Gmail (Gmail add-on only: sender address, subject, message text) | Read inside your browser only to find the right customer and order number. | No. It is never transmitted anywhere by OrderPeek. |
| Shopify access used by the admin page | Held by Shopify. We hold no token for the admin page. | No. |
| Shopify access and refresh tokens (Gmail add-on only) | Stored in your browser (chrome.storage.local). |
They pass through our server in memory during sign-in and token refresh (about every hour). They are not stored or logged. |
| Connection code | A signed code that works for 10 minutes and contains only your shop's domain. Our server creates it when you ask for it on the admin page's Gmail add-on tab, after checking Shopify's session token. It contains no token or password. | We create it; we do not store it. |
| Reply templates, late limits and sign-off | Saved in your own Shopify store (an app-owned metafield). The admin page and the Gmail add-on read it; the add-on keeps a copy in your browser. | No. |
| Monthly lookup counter (Gmail add-on) | Your browser only. It keeps a one-way fingerprint of each looked-up thread and query for the current month (to count lookups), not the customer's email or your search text. | No. |
| Plan and billing status | Shopify App Pricing: you choose a plan on Shopify's plan page and Shopify bills you; the app asks Shopify which plan the store is on. | No. We do not see payment details. |
| Uninstall / mandatory privacy webhooks from Shopify | Our server acknowledges them. | We hold no customer or shop data, so there is nothing to delete or export. |
Our server (a Cloudflare Worker) has request logging switched off. It handles only: checking Shopify's session token when you create a connection code, the Shopify sign-in handshake and token refresh for the Gmail add-on, and Shopify's required webhooks. It also serves the admin page's static files; the admin page reads orders through Shopify, not through our server.
Third parties
- Shopify: the source of order data, the place your settings are saved, and our billing. Governed by Shopify's own terms and privacy policy.
- Cloudflare: hosts our small server. It processes network traffic as any host does.
- InboxSDK (Streak): the open-source library that lets the Gmail add-on display inside Gmail. The library sends its own usage events and
error reports to
api.inboxsdk.com, which can include a hash of your email address, a session identifier and the name of the Gmail feature used. OrderPeek does not add order or customer data to those reports. InboxSDK is operated by Streak; see Streak's privacy policy. - Google: Gmail is where the optional extension runs. We do not use the Gmail API and have no access to your Google account.
We do not sell data, use it for advertising, or use it to train AI models.
Shopify access
OrderPeek requests the Shopify scopes read_customers and read_orders (read-only) and, because they include personal data,
works under Shopify's Protected Customer Data requirements. It cannot create, change, refund or cancel anything.
Retention and your choices
- Disconnecting a store in the Gmail add-on's settings deletes its tokens from your browser immediately. To also revoke Shopify's side, uninstall the app in your Shopify admin.
- Uninstalling the extension removes everything it stored in your browser. Your saved settings are in your own Shopify store, under your control there.
- Because we store nothing about you or your customers, there is nothing to request from us. Questions about a specific customer's data should go to the store that holds it.
Security
The admin page runs inside Shopify's admin using Shopify's App Bridge and session tokens, and is served with a strict content security policy. The Gmail add-on's tokens stay in the extension's private storage (not readable by Gmail or other pages). Sign-in uses Shopify's OAuth with signed state and HMAC verification; traffic is HTTPS only.
Changes
We will post updates here and update the date above. Material changes will be announced in the extension.