Privacy policy

Last updated 20 September 2026. Controller: Geary Works, 1380 Rio Rancho Blvd SE #470, Rio Rancho, NM 87124, USA · mike@gearyworks.com.

What we collect

• Shop data: your myshopify domain, shop name, contact email and the access token Shopify issues to the app. Needed to run the app and to bill through Shopify.
• The staff account that opens the app: when Shopify issues a session it hands us that user's Shopify user ID, first and last name, email address and language, and we store them in the session record. We never use them for anything else — no mail, no profiling — and they are deleted with the rest of your shop's data.
• Product data: product and variant titles, descriptions, vendor, product type, tags, HS code, country of origin and weight. Needed to scan and suggest.
• Usage data: which actions are run in the app and when — a scan, a batch of suggestions, an apply, an undo — with counts, never product or customer detail. Collected with PostHog. Your shop domain is hashed before it is sent, so PostHog can count returning stores without holding the identity of one.
• Error reports: when something breaks, the error and the page it happened on go to Sentry so we can fix it. Sentry is configured not to collect personal data.

We do not collect your customers' personal data. The app does not request access to orders or customers.

Where it goes

• Product titles and descriptions are sent to Anthropic's Claude to generate HS code suggestions, routed through the Vercel AI Gateway. Anthropic does not train on API data. Only the fields above are sent — never customer data.
• Product keywords are sent to the US International Trade Commission's public tariff search to check that a suggested code really exists. Nothing identifying your shop goes with them.
• Data is stored on Vercel (hosting) and Neon (database) in the United States.

How long

Scan results are kept while the app is installed so you can undo changes. The moment you uninstall, Shopify tells us and we delete your sessions — including the staff details above — straight away. Shopify sends the shop-redact request 48 hours after that, and on it we delete everything else we hold for your shop. If you want it gone sooner, email us and we will do it by hand. Shopify's customer data-request and redact webhooks are honoured automatically; the app holds no customer data to return or erase.

Your rights

Email mike@gearyworks.com to access, correct or delete your data. EU/UK merchants may also lodge a complaint with their supervisory authority.

Cookies

The app runs inside Shopify admin and uses Shopify's session token, not its own cookies. hscodefix.com sets no cookies.