Voto Polls privacy policy — effective 2026-10-07

Voto Polls is a Shopify app made by Eric William Stevenson, LLC. This policy covers what the app stores and why.

What we store for a merchant: the shop's domain, the plan, the polls and options the merchant creates (question, labels, image URLs), and the access token and refresh token Shopify issues to the app so the app can run inside the admin. We read product images only to let the merchant pick them for a poll.

What we store when a shopper votes: the chosen option, the time, and two hashes: one of a random token kept in the shopper's browser and one of the network address, so a vote counts once per browser and a network cannot vote without limit. Each is a keyed hash (HMAC-SHA256), so the stored identifier cannot be turned back into a voter identity or an address without the app's secret key. The app's database holds no names, emails, customer IDs, orders or anything else about the shopper.

What we do not do: no tracking across shops or sites, no advertising, no sale or sharing of data. The storefront poll widget sets no cookies; the only thing it keeps in the shopper's browser is the one random token used to count votes, held in the browser's local storage under a single key. The merchant admin runs inside Shopify and signs in with Shopify's session tokens; the app keeps that session on its own server, not in the merchant's browser.

Request logs: requests to the app pass through our load balancer, which keeps standard access logs: the time, the request address (which can include a shopper's Shopify customer ID when Shopify forwards a storefront request from a signed-in shopper, and the short-lived sign-in token Shopify adds to admin page loads), the caller's IP address and browser type. We use these logs only to operate and debug the service and delete them after 30 days.

Deletion: when a merchant uninstalls the app, every poll, option and vote for that shop is deleted. Shopify's data-request and redaction webhooks are honored; because the app's database holds no customer identity, a customer data request returns nothing and a redaction request has nothing to remove beyond those log lines, which expire on their own. Deleted rows can remain in our database backups for up to about eight days before those backups expire.

Where data lives: on servers in the United States (Amazon Web Services, us-east-1). Images uploaded through the app are stored on Shopify's CDN under the merchant's Files.

Contact: eric@ericstevenson.com.