1. Introduction

ThemeSweep ("we", "our", or "us") is operated by JMS Dev Lab. This Privacy Policy explains how we collect, use, and protect information when you use the ThemeSweep application and related services (the "Service"). This policy describes our handling of that information.

2. Information We Collect

ThemeSweep collects only the minimum data necessary to provide our Service:

Store information: Your Shopify store domain and a contact email address when Shopify provides one during installation.
Theme file metadata: File names, file sizes, and code contents of your Shopify theme files. This data is used solely to scan for potential leftover-code candidates and static-reference issues.
Shopify API access tokens: OAuth tokens granted during app installation, used to read and modify theme files on your behalf.
Scan results and reports: Detection results, confidence scores, and cleanup history generated by our scanning engine.
Billing information: Subscription status managed through Shopify Billing. We do not store credit card numbers or payment details directly.
Legacy account information: If you previously used ThemeSweep's retired standalone portal, its historical records may include your email address, name, password hash, store link, and security log. ThemeSweep no longer accepts standalone merchant accounts.

What we do NOT collect: ThemeSweep does not access, store, or process any customer personal data, order data, product data, or any information about your store's customers. We only access theme files.

3. How We Use Your Data

We use the collected information for the following purposes:

Scanning Shopify theme files for potential leftover app code and static-reference issues
Generating scan reports with detection results and confidence scores
Creating theme backups before applying cleanup operations
Applying code cleanup changes to your theme files upon your request
Managing your subscription and billing through the Shopify Billing API
Sending requested operational notices and a short, bounded setup-help sequence after installation
Recording support, assisted-setup, and feature requests you submit in the app
Improving our detection accuracy and service quality

4. Data Retention

Theme backups created during cleanup operations are automatically deleted after 30 days.
Scan results and reports are retained while ThemeSweep remains installed so you can review history and use rollback features.
Store data (store domain, access tokens, scan history, findings, and backups) is deleted when Shopify sends its mandatory shop-redaction request after uninstall, or within 30 days of a verified deletion request.
Legacy standalone account data is retained only for migration, security, and deletion handling. You may request its deletion using the contact address below.
Support requests and email delivery evidence are retained while needed to answer the request, honour unsubscribe/bounce/complaint signals, prevent duplicates, and demonstrate delivery. We store address hashes in campaign evidence rather than repeating the address.
Stored access tokens are cleared immediately when we receive Shopify's uninstall webhook.

5. GDPR Compliance

ThemeSweep is designed with privacy by default. We are committed to complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws:

No customer PII: We do not store any personally identifiable information about your store's customers. Our access is limited exclusively to theme files.
Data deletion on request: You may request complete deletion of all your data at any time by contacting us at support@themesweep.com. We will process deletion requests within 30 days.
Automatic deletion after uninstall: ThemeSweep clears active credentials on the uninstall webhook and deletes the remaining store record when Shopify sends the mandatory shop-redaction request.
Data portability: You may request an export of all data we hold about your store by contacting us.
Shopify data protection: We implement Shopify's mandatory privacy webhooks for data access and erasure requests.

6. Third-Party Services

ThemeSweep uses the following third-party services to operate:

Shopify API: To access and modify your store's theme files, and to manage billing through Shopify's subscription system.
Cloud hosting provider: Our application servers and databases run on managed cloud infrastructure with access controls and encrypted network connections.
Resend: Resend processes the delivery address and message needed for requested operational notices, the bounded post-install setup-help sequence, and one-time customer-success messages. We record accepted, delivered, bounced, complained, suppressed, or failed outcomes and provide an unsubscribe link for optional messages.
JMS Dev Lab operations dashboard: We may send a minimal activation event containing the ThemeSweep app identifier, event name, a random internal store ID, and aggregate event metadata. We do not send merchant email addresses, Shopify domains, access tokens, or theme contents in these events.
Training guides: The public training centre currently provides written guides.
Google and Meta: Optional analytics and advertising-measurement tags on public pages receive page, device, referral, and campaign information only after you accept optional cookies. We do not send theme files, scan findings, store records, or Shopify account data to these tags. You can change or withdraw your choice at any time with Cookie settings in the footer of any page. Withdrawing consent stops these tags and deletes the analytics and advertising cookies they set on themesweep.com (such as _ga, _gcl_au, and _fbp). Cookies that Google or Meta store on their own domains can only be removed in your browser settings, and withdrawal does not affect data already sent while consent was given.

We do not sell or trade your data. Optional marketing-page measurement is limited to the consented visit data described above.

7. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/HTTPS), encryption at rest for stored data, secure token storage, and access controls. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of ThemeSweep after changes are posted constitutes acceptance of the revised policy.

9. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: support@themesweep.com