Picklio Privacy Policy

Last updated: September 21, 2026

Picklio (“we”, “us”, or “our”) provides warehouse pick-list and picking tools for merchants who use Shopify to run their stores (the “App” and the “Service”). This Privacy Policy explains how we collect, use, store, and share information when you install or use the App in connection with your Shopify store.

By installing or using the App, you agree to the practices described in this policy. If you do not agree, please uninstall the App.

1. Who this policy applies to

This policy applies to merchants and authorized users who access the App through the Shopify Admin (for example, store owners and staff).

The App is embedded in the Shopify Admin. It is not installed on your online storefront and does not place cookies or tracking technologies on your customers’ browsers when they shop on your store.

2. Information we collect

2.1 Information from Shopify when you install or use the App

When you install the App, Shopify shares information with us as part of OAuth and session management. Depending on how you and your staff use the App, this may include:

  • Your shop domain (for example, your-store.myshopify.com)
  • Staff user identifiers and profile fields made available by Shopify (such as user ID, name, email, locale, and whether the user is the account owner)
  • Access tokens and related session data needed to authenticate API requests on your store’s behalf
  • App permission scopes granted at installation

We store session data in our application database to maintain secure access to your store while the App is installed.

2.2 Information we collect from Shopify’s APIs to provide the Service

To sync pick lists, display products and orders, and support picking workflows, we request and process data from your store using Shopify APIs. The App requests these access scopes: read_orders, read_products, and read_merchant_managed_fulfillment_orders.

Depending on your settings and usage, we may process:

Order and fulfillment-related data (for unfulfilled / open fulfillment work)

  • Order identifiers (Shopify GIDs)
  • Order names (for example, #1001)
  • Fulfillment order identifiers and fulfillment status
  • Line item identifiers, quantities, and shipping-related flags

Product and catalog-related data

  • Product and variant identifiers
  • Product titles, variant titles, SKUs, and vendor names
  • Bin location values read from product or variant metafields that you configure in the App settings

Operational / sync metadata

  • Sync status, date-range filters, bulk operation identifiers, timestamps, and error messages related to pick-list synchronization

We use this information only to generate aggregated pick lists, support print and CSV export, run in-App picking sessions, and keep your pick list up to date when you enable automatic updates.

What we do not store from your customers

We do not intentionally collect or store your customers’ names, email addresses, phone numbers, or shipping addresses in our database. Order and product fields above may indirectly relate to a customer order, but the App is designed for fulfillment operations, not customer marketing or profiling.

2.3 Information you provide in the App (merchant settings)

We store configuration you choose in the App, such as:

  • Which metafield defines bin location (namespace, key, and owner type)
  • Default order date range for syncing
  • Preferences for automatic updates (for example, when opening the pick list or when orders change)

We do not require a separate merchant registration form beyond installing the App through Shopify.

2.4 Picking session data

If you use Picking in the App, we store picking session data tied to your shop, including:

  • Product, SKU, vendor, and bin location fields copied from your synced pick list
  • Quantities required and quantities marked as picked
  • Order names associated with each pick line (stored as JSON for session display)

Picking updates Picklio’s session only. The App does not create fulfillments or change order status in Shopify unless you do so separately in Shopify Admin.

2.5 Server logs

Like most web applications, our servers may automatically log technical information such as IP addresses, request timestamps, app routes accessed, and error diagnostics. We use logs to operate, secure, and troubleshoot the Service. We do not use these logs to track your storefront visitors.

2.6 Information from Shopify’s billing and Partner systems

If you subscribe to a paid plan, we check subscription status (including trial status and billing period information) through Shopify’s billing systems and the Shopify Partner API. We do not receive or store your full payment card details; billing is handled by Shopify.

3. How we use information

We use the information described above to:

  • Provide, maintain, and improve the App and Service
  • Authenticate your store and authorized users
  • Sync, aggregate, sort, print, export, and display pick lists
  • Run picking sessions and optional automatic updates when you enable it
  • Verify active subscriptions and trials
  • Respond to support requests you send us
  • Comply with legal obligations and Shopify App Store requirements
  • Detect, prevent, and address fraud, abuse, or security issues

We do not use merchant or order data for third-party advertising. We do not sell personal information.

4. Webhooks and automated processing

The App registers webhooks with Shopify to operate the Service, including:

  • app/uninstalled — to remove App-related data when you uninstall
  • orders/updated — to optionally queue pick-list sync when orders change (if you enable this setting)
  • bulk_operations/finish — to complete pick-list sync jobs
  • Mandatory GDPR webhooks: customers/data_request, customers/redact, and shop/redact

When we receive customers/redact, we delete pick-list records associated with the order IDs Shopify provides. When we receive shop/redact, we delete App data associated with your shop as described in Section 6. When we receive customers/data_request, we acknowledge the request; Picklio does not maintain a separate customer profile database beyond fulfillment-related records derived from Shopify. If Shopify or a customer contacts us about a data request, we will assist as required by applicable law and Shopify’s processes.

5. How we share information

We share information only as follows:

Shopify

Data is accessed from and processed in connection with your Shopify store as necessary to provide the App.

Service providers (subprocessors)

We use hosting and infrastructure providers to run the App (for example, Railway for application hosting and a PostgreSQL database for data storage). These providers process data on our behalf under contractual obligations appropriate to their role.

Legal and safety

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Picklio, merchants, or others.

We do not share merchant data with other merchants.

6. Data retention and deletion

We retain information for as long as your store has the App installed and as needed to provide the Service.

When you uninstall the App, we delete shop-related App data from our database, including synced pick-list lines, sync state, shop settings, picking sessions, and Shopify session records for your shop.

After a shop redact request (under Shopify’s mandatory compliance webhooks), we delete App data associated with your shop in line with our deletion procedures.

After a customer redact request, we delete pick-list line records tied to the specified orders. Picking session copies may still exist until you uninstall the App or a shop-level redact occurs; those copies are tied to your shop’s operational data, not a standalone customer profile.

You may contact us (Section 12) to ask questions about deletion. Some information may be retained where we are legally required to do so or for limited backup retention that is automatically purged on a rolling basis.

7. Security

We use administrative, technical, and organizational measures designed to protect information, including encrypted connections (HTTPS), access controls, and secure storage of access tokens. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

8. International data transfers

We may process and store information in countries other than where you or your customers are located (for example, where our hosting providers operate). Where required, we rely on appropriate safeguards for cross-border transfers.

Data controller roles: For App data processed about your store and staff users, you are typically the controller of your customers’ personal data in Shopify; Picklio acts as a processor / service provider on your instructions to provide the App. For information about how we operate Picklio as a business (for example, if you email support), Picklio may act as a controller as described in this policy.

Our location: [Picklio is operated by an individual based in China. Picklio is not a registered company. Hosting is provided by Railway, as described in Section 5.]

9. Your choices and rights

Depending on your location, you or your customers may have rights to access, correct, delete, or restrict certain processing of personal information, or to object to processing.

  • Merchants: You can uninstall the App at any time through Shopify Admin. You can adjust sync and metafield settings in the App.
  • Customer requests: Many requests are submitted through Shopify’s privacy tools; we respond to mandatory Shopify compliance webhooks and cooperate with merchants as required by law.

To exercise rights or ask questions, contact us using Section 12. We may need to verify your identity or your authority to act on behalf of a store.

10. Children

The App is intended for businesses and is not directed to children. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date at the same public URL as this policy. If changes are material, we may provide additional notice through the App or App Store listing. Continued use of the App after the effective date constitutes acceptance of the updated policy.

12. Contact us

If you have questions about this Privacy Policy or our data practices, contact us:

Picklio