Privacy policy
Last updated: 20 October 2026. This policy covers OmniPrice Guard, an app that is part of Wharfly.
Who we are
OmniPrice Guard is operated by Wharfly (wharfly.app). Contact: opg@wharfly.app, or see the support page.
What we collect
When a merchant installs the app we receive and store:
- The shop's myshopify.com domain, currency and the countries the merchant selects.
- An access token that lets the app read and update products in that shop. It is encrypted at rest.
- Product and variant titles, SKUs, tags and creation dates.
- Prices and compare-at prices per variant and market, with timestamps, and the prior prices and promotions we calculate from them.
- Whether the shop has an active subscription, as reported by Shopify. We do not see payment details.
- App settings, and logs of price history exports (date range and row count, not the file).
We do not collect or store customer or shopper personal data. The storefront block shows a price and reads the shopper's country from Shopify only to choose the right value; nothing about the shopper is sent to us. We use no cookies or trackers on the storefront.
How we use it
To calculate and display prior prices, to show warnings and the price history export to the merchant, to operate and secure the service, and to answer support requests. We do not sell data and do not use it for advertising.
Where it is processed
The app runs on Cloudflare (Workers, D1 database and Queues). Shopify provides the platform and billing. These are our only sub-processors for merchant data.
How long we keep it
While the app is installed. After uninstall, Shopify sends us a request to erase the shop's data (normally 48 hours later) and we delete every record for that shop, including price history. The app's storefront data fields and theme block are removed by Shopify when the app is uninstalled. Merchants can also ask us to delete their data sooner by email.
Customer data requests
Because we hold no customer data, requests received through Shopify's customer data webhooks are acknowledged and require no action.
Security
Access tokens are encrypted with AES-256-GCM. Requests from Shopify are verified by signature, and admin requests use Shopify session tokens. Access to production data is limited to the operator.
Your rights
Under the GDPR and similar laws you may ask for access to, correction of or deletion of personal data we hold about you, such as a merchant contact email. Write to opg@wharfly.app. You may also complain to your data protection authority.
Changes
We will update this page when the app's data practices change and change the date above.