Privacy Policy

Mega Subscription · Last updated October 19, 2026

Mega Subscription is a Shopify app that lets merchants sell products on a recurring schedule. This policy explains what the app accesses, what it stores, and how long it keeps it.

The merchant who installs the app controls their store's data. Mega Subscription acts on that merchant's behalf and processes data only to provide the app's functionality.

What the app stores

The app keeps only what it needs to operate. Its database contains:

Data	Why
Store domain and app settings	To identify the store and remember setup choices, such as which widget layout is selected.
Shopify access tokens and session metadata	To call the Shopify API on the store's behalf. Shopify sessions can include staff account identifiers, names, email, and locale.
Subscription plan settings created by the merchant	Delivery frequency, discount, and which products a plan applies to.
Billing attempt records	The Shopify identifiers for a renewal attempt, its outcome, and any payment error, so failed renewals can be surfaced and retried.
Customer data requests	Request identifier, store, customer and order identifiers, receipt date, and review status. This lets the merchant track requests and download the matching billing records.
Extension activation and performance diagnostics	Latest placement status, store domain, app route, timing and layout metrics, viewport size, and whether authentication was validated. Used to troubleshoot setup and performance. Diagnostic snapshots do not store session tokens or customer content.

The app does not keep a separate customer directory. No customer names, email addresses, phone numbers, or shipping addresses are written to its database. Billing attempt records hold Shopify identifiers, outcomes, and payment error details. These identifiers can be linked to a customer within the merchant’s Shopify store.

What the app reads without storing

To display subscriptions to the merchant and to the subscriber, the app reads the following from Shopify when needed for a page. Customer details are not persisted in the app database; aggregate dashboard metrics are cached in server memory for up to 30 seconds:

Subscription contracts, including status, delivery schedule, and price
The subscriber's name, email address, and phone number
The shipping address on a subscription
Orders created by a subscription
Products, variants, prices, images, and theme settings

Payment information

The app never receives, handles, or stores card numbers or other payment credentials. When a subscriber updates their payment method, the app asks Shopify to send them a secure link, and the details are entered directly with Shopify. The app only ever sees an identifier for a stored payment method, never its contents.

Where data is held and how it is protected

Hosted on Fly.io in the United States (region iad).
All traffic is encrypted in transit with HTTPS.
Stored data sits on an encrypted volume.
Requests from Shopify are verified before they are processed.

Fly.io hosts the app. Shopify provides authentication, payment processing, and App Bridge performance measurement. We use technical diagnostics to maintain the app. We do not sell data or share it for advertising or marketing.

Browser storage

The app uses session storage to remember dismissed setup messages for the current store and browser tab. This is optional interface state, not authentication. Authentication uses Shopify session tokens.

Retention and deletion

When the app is uninstalled, the store's record, its subscription plan settings, access tokens, billing attempt records, and activation and performance observations, and data request records are deleted from the app database.
On a store data erasure request from Shopify, any remaining data for that store is deleted.
On a customer data erasure or access request from Shopify, records associated with the supplied order identifiers are reviewed. Erasure removes matching billing records and related attempts for the same contracts. Requests that cannot be linked automatically require review with the merchant through our support contact. The merchant can track requests and download linked billing records in Privacy requests in the app. Downloading an export or marking it reviewed does not send a response to the requester.

Subscriptions themselves live in Shopify, not in this app. Uninstalling the app does not delete a store's subscription contracts.

Your rights

If you are a shopper and want to see, correct, or delete the personal information a store holds about you, contact that store directly. They control the data and can pass the request to Shopify, which will relay it to this app automatically.

Changes to this policy

If the app's data handling changes, this page is updated and the date at the top changes with it.

Contact

Questions about this policy can be sent through the support channel listed on the app's Shopify App Store listing.