Privacy Policy

1. Who we are

SizeCast ("the app", "we", "us") is a Shopify application built and operated by Spell Agency. For any privacy question or request, contact us at hello@spell.agency. When you install SizeCast on your Shopify store, you (the merchant) are the data controller for your store's data, and we act as a data processor on your behalf.

2. Shopper measurements — processed in the browser, never collected

The core of SizeCast is a size calculator that your customers use on your product pages. When a shopper enters their height, weight, and any optional measurements:

• The calculation runs entirely in the shopper's web browser using JavaScript. The measurements are compared against your size chart on the device itself.
• These measurements are never sent to SizeCast's servers, to Spell Agency, or to any third party. We never receive them and cannot see them.
• To make return visits convenient, the shopper's most recent entries may be saved in their browser's own localStorage — a private store on their device. This data stays on that device, is readable only by your storefront, and the shopper can clear it at any time through their browser.

Because these measurements are never transmitted or stored by us, SizeCast holds no shopper personal data and there is nothing for us to disclose, sell, or breach.

3. Your size charts — stored in your own store

The size charts you create are saved as metaobjects and metafields inside your own Shopify store, using Shopify's native data platform. They are your data, held on Shopify's infrastructure under your control. This means your charts continue to work even if the app's server is unavailable, and you can export them to CSV or remove them at any time. We do not keep a separate copy of your chart content on our servers.

4. What SizeCast stores on its own server

To run the merchant-facing admin (the dashboard you use inside Shopify), our server stores a minimal session record for your store:

• Your store's myshopify.com domain.
• The offline access token Shopify issues so the app can read and write your size charts and product assignments on your behalf.
• Basic session metadata required by Shopify's app framework (for example, the granted permission scopes and token expiry).

This record contains no customer data and no billing details. It exists only so the app can authenticate to the Shopify Admin API and display your dashboard. It is deleted when you uninstall the app.

5. Permissions we request, and why

SizeCast requests only the access scopes it needs to function:

• Products — to read your products and to write the metafield that links a product to a size chart.
• Metaobjects and their definitions — to create and manage size charts as native store data.
• Themes — to help you add the "Find my size" button to your product template through the theme editor.

SizeCast does not request access to customers, orders, financial data, or any protected customer information, because it does not need them.

6. Sub-processors and third parties

SizeCast does not sell, rent, or share data with advertisers or data brokers. The limited infrastructure we rely on:

• Shopify — the platform your store and our app run on. Your interactions with the admin pass through Shopify. See Shopify's own privacy policy for how Shopify handles data.
• Our hosting provider (Hetzner) — the server that runs the app is hosted on infrastructure in the European Union, secured with industry-standard TLS encryption in transit.

No other third parties receive data from SizeCast. The storefront widget loads no external analytics, advertising, or tracking scripts.

7. Anonymous usage events

When a shopper interacts with the widget, SizeCast may emit anonymous interaction events (for example, "calculator opened" or "size recommended") through Shopify's own storefront analytics. These events contain no body measurements and no personal identifiers, and they are handled within your store's Shopify analytics — they are not sent to us.

8. Data retention and deletion

We keep your store's session record only for as long as SizeCast is installed. When you uninstall the app, Shopify notifies our server and the session record for your store is deleted. Your size charts remain in your own store's data under your control; you can delete them yourself at any time, before or after uninstalling.

SizeCast honours Shopify's mandatory privacy webhooks:

• Customer data request — because SizeCast stores no customer data, there is no customer information to return.
• Customer redaction — no action is required, as no customer data is held.
• Shop redaction — when a store is closed, we delete that store's session record from our server.

9. Your rights (GDPR, CCPA and similar)

Depending on where you and your customers are located, applicable law may grant rights to access, correct, or delete personal data. Because SizeCast processes no shopper personal data and stores only a technical session record for merchants, most such requests are satisfied simply by uninstalling the app. For any request, contact hello@spell.agency and we will respond promptly.

10. Security

All communication between the storefront, the Shopify admin, and our server is encrypted in transit using TLS. Access tokens are stored server-side and are never exposed to the browser. Because SizeCast deliberately collects no customer personal data, the sensitive-data surface that could be exposed in a breach is minimal by design.

11. Children

SizeCast is a tool for merchants and is not directed at children. It does not knowingly collect personal information from anyone, including children.

12. Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with a new effective date. Continued use of SizeCast after an update constitutes acceptance of the revised policy.

13. Contact

Questions, requests, or concerns about privacy can be sent to hello@spell.agency. We aim to respond within a few business days.