Privacy policy
Lit File Upload adds an upload field to a Shopify store's product pages, so shoppers can attach files and photos (a logo, a photo for a mug, artwork for a print) to the item they buy. The store gets the files with the order. This page says exactly what data the app processes, why, where it lives and for how long.
Last updated 22 October 2026
The short version
The app stores the files shoppers upload, in a private storage bucket that nobody can browse. When an order comes in, it notes which files belong to which order and line item. Files that never become part of an order are deleted after 7 days. Order files are deleted when the store's retention period ends (90 days, 1 year or 2 years, depending on the plan). The app stores no shopper name, email, address or customer account. We sell nothing, run no ads, set no cookies and share data only with the processors listed below.
Who is responsible
For shopper data, the merchant (the Shopify store that installed the app) is the controller: they decide to ask shoppers for files and what to do with them. Lit Dog Labs, the maker of this app, processes that data on the merchant's behalf and only on their instructions. For the merchant's own account data (below), Lit Dog Labs is the controller.
What we process about merchants
| What | Why | Kept |
|---|---|---|
Shop details: .myshopify.com domain, storefront domain, shop name,
contact email, owner name and email, primary language, currency, time zone, plan |
To run the app: the plan sets the monthly limit, file size and retention; the contact email gets a note when the monthly limit is reached; the owner address gets one welcome and one uninstall email from us. | Until 48 hours after uninstall (Shopify's shop/redact) |
| Shopify access token | To read orders and products through Shopify's Admin API for your shop. | Deleted the moment the app is uninstalled |
| Your settings: upload fields, allowed file types, sizes, image checks, which products show a field | To show the right field to shoppers. | Until shop/redact |
| Support emails you send to support@lit.dog | To answer you. | As long as needed for the conversation |
What we process about shoppers
| What | Why | Kept |
|---|---|---|
| Uploaded files and a small preview image of each picture, with the file name, type, size, pixel size, the product page it was uploaded on, and the time | To give the store the files for the order (admin, order page, ZIP download). | Not ordered: deleted after 7 days. Ordered: until the store's retention period ends (90 days on Free, 1 year on Pro, 2 years on Plus, counted from the order), or earlier when the store deletes them |
| Order link: order id and number, line item id and product title. Read from the order once, when Shopify reports a new order that carries uploaded files | To show each file on the right order. | As long as the file |
| IP address, as a one-way hash that changes every day | To stop abuse (too many uploads from one address). | Deleted with the file |
The app reads the order only for the file ids in its line items. It does not read or store the customer's name, email, phone number or address. The upload field sets no cookies. While a shopper uploads, the browser keeps the file list for that product in session storage until the tab is closed.
Who can see the files
Files are private. There is no public link and no listing. The store's staff see them inside the Shopify admin (the app and the order page); each preview or download link is signed and expires after one hour. Lit Dog Labs does not look at uploaded files except when the merchant asks us to in a support case.
Processors
- Cloudflare, Inc.: hosting (Workers), file storage (R2), database (D1), queues, and email sending (Cloudflare Email Service).
- Shopify: the platform the app runs on; the file names and ids travel with the order as line item properties.
There are no analytics vendors, advertising networks or third-party scripts in this app.
Permissions
The app asks only for what it uses: orders (read only, to match uploaded files to new orders), products (read only, to pick which products show an upload field) and the shop's languages. Shopify protected customer data: order data only, no customer fields.
Shopper rights
- Access and deletion through the store: when the store forwards a request through
Shopify (
customers/data_request), we email the store the files we hold for that customer's orders; oncustomers/redactwe delete those files. - Shoppers can also write to us directly at support@lit.dog; we pass the request to the store and act on it.
When a merchant uninstalls
The access token is deleted at once and the upload field stops working. 48 hours later Shopify
sends shop/redact and we delete everything we hold for that shop: every file, the order
links, settings and counters.
Security
All connections use TLS. Uploads go straight into private storage with a one-time upload ticket; each file must match its file type or it is deleted. Downloads are served with headers that stop a file from running code in the browser. Shopify webhooks are verified by their HMAC signature, admin requests by Shopify session tokens. Production and development run on separate databases and buckets with no shared data. Secrets live in Cloudflare's encrypted secret store, never in code. Access to the systems is limited to Lit Dog Labs' owner. If we suspect an incident we rotate credentials, roll back to the last good release, establish what was reached, and notify affected merchants and Shopify within 72 hours of becoming aware.
Contact
Questions, or a data request of any kind: support@lit.dog. We answer within two business days.