Snapshots

Our privacy page is a short preview, and the code does more

Waiting on you
  • Ten things the code does are missing from the page, like OpenAI and Higgsfield receiving data.
  • Shopify customer names, emails, phones and addresses are never read; only totals are kept.
  • A 12-point plain-words final policy is drafted, naming Yellow Monk Technologies LLP.
  • Meta's app settings still point the privacy URL at staging.
  • A lawyer must review the final policy before the product opens to everyone.
10policy gaps on 26 Oct
Your call

Who reviews the final policy, and before which brand signs up outside the five partners?

Security, privacy and legal · 9.1

Privacy policy

DraftLast checked Mon Oct 26Owner Param

Answer

The privacy page today is a short preview policy dated 19 October 2026; this document lists what it says, where the code does more than it says, and the proposed final policy in plain words that a lawyer must review before the product opens to everyone.

Today

What the page says

Section What it says Source
Label Preview policy, updated 19 October 2026, served at /privacy on every site brew/legal-pages.js:6, 18, 53
Status A design partner preview; a full policy comes before opening to everyone brew/legal-pages.js:19
What is read The store's public site, public reviews, rivals' public sites, ads in Meta's public Ad Library, what AI assistants answer about the category brew/legal-pages.js:21
Connected accounts Only if the team connects them; read only; keys encrypted; only the team sees the numbers; Slack posts only to the picked channel brew/legal-pages.js:23
Shopify Reads products, stock, orders and how many orders each customer placed; never names, emails, phones or addresses; keeps totals only; uninstall stops every read; honours Shopify's data and erasure requests brew/legal-pages.js:25
Sign in Google gives name, email address and photo; inside Shopify, Shopify signs the person in brew/legal-pages.js:27
Where it is kept Google Cloud; AI models on Google Cloud; public data through data providers; finals by Sloosh; email through Resend brew/legal-pages.js:29
Who sees what The team sees the feed, jams and connected numbers; anyone else only what is public brew/legal-pages.js:31
Deleting Email hello@joinsquareup.com from the work address naming the store; we delete the read, Plays, jams and connected keys and reply; no time given brew/legal-pages.js:33
Contact hello@joinsquareup.com brew/legal-pages.js:5

What the code does that the page does not say

  • OpenAI receives voice notes for transcription, and photos and prompts for image edits, images and speech. brew/server.js:1038 brew/media.js:27-35
  • Higgsfield receives prompts and pictures when its keys exist on production. brew/jam2/engines.js:7, 60 brew/tools/prod-env.sh:12
  • The Anthropic key is mounted on production while text runs on Gemini through Vertex. brew/tools/prod-env.sh:9-10
  • Every signed in email that opens a brand is logged with how it got in: brew, team, official or blocked. brew/server.js:657-666 brew/db/migrations/003_access.sql:19-29 memory brew-access-rules
  • Each sign in writes a session row with the email and the browser's user agent; an IP column exists but sign in does not fill it. brew/sessions.js:19-22 brew/auth.js:88
  • Cookies: fs_s, the session, 30 days; fs_g, the sign in handshake, 10 minutes. brew/auth.js:224, 244
  • Teams upload notes, files and photos into brand memory and References. brew/SCOPE.md:22-23
  • Team email is sent: invites, joins, view changes, Plays ready and a weekly digest. brew/SCOPE.md:25
  • The Delete my data sheet promises 7 days; the page gives no time. brew/public/live.js:348-351 brew/legal-pages.js:33
  • Shopify's three compliance webhooks are handled: no per customer record to send or erase; shop/redact drops the store's token and numbers. brew/shopify-app.js:15-19, 30, 203-217

Problems with the page as written

  • It names no legal entity, no address, no retention periods and no legal basis. brew/legal-pages.js:18-33
  • It uses the product name and the old word for Plays, and names the company behind Sloosh, against the writing rules for anything a customer reads. brew/legal-pages.js:29-31
  • Meta's app settings point the privacy and data deletion URLs at the staging site, brew.joinsquareup.com/privacy. memory brew-meta-app-review
  • A cookie banner was left open by decision on 19 Oct. memory brew-qa-sweep-2026-10-19

Tomorrow

Item Version Tag
The final policy below replaces the preview page, after a lawyer's review v1 Changes
Name Yellow Monk Technologies LLP as the controller, with a postal address v1 New
State every subprocessor, matching the Subprocessors page v1 Changes
State retention periods, matching Retention and deletion v1 New
State the 7 day deletion promise the sheet already makes v1 Changes
Point Meta, Shopify and Google at production's privacy URL v1 Changes
Add what posting and scheduling read and write when v2 adds them v2 Changes
Add how results are measured and what is kept when v3 adds them v3 Changes

The proposed final policy, in plain words

This is a draft for Param and a lawyer. It is not legal advice.

  1. Who we are. The service is run by Yellow Monk Technologies LLP, India. Write to hello@joinsquareup.com about anything on this page. Address to add.
  2. What we read about your store. Your public website, products and prices, public reviews, your rivals' public sites, public ads in ad libraries, public posts and threads about your category, and what AI assistants answer when shoppers ask about it.
  3. Accounts you connect. Only the ones your team connects: Shopify, Meta Ads, Google Ads, Google Analytics, Klaviyo, Judge.me and Slack. Access is read only. We never change your accounts. Keys are encrypted and never shown in a page or a log. Only your team sees the numbers.
  4. Your store's customers. From Shopify we read order totals, dates and how many orders each customer placed. We never read customers' names, emails, phones or addresses, and we keep totals, never a record of one customer.
  5. About you. When you sign in with Google we get your name, email address and photo. We keep a record of each sign in with your browser type, and of which brands your email opened, so we can end sessions and keep brand data with the brand's own people.
  6. What your team adds. Notes, files, photos and messages your team adds in jams, memory and References stay with your brand.
  7. Who helps us. Google Cloud stores the data and runs most of the AI. OpenAI and Higgsfield make some pictures, voice and transcripts. Sloosh makes finals your team pays for. Resend sends our emails. Data providers fetch public data. The full list is on our subprocessors page.
  8. Who sees what. Your team sees your feed, Plays, jams and connected numbers. Anyone else sees only public data, and not even that while your store is still behind Shopify's password page. Our own staff can open every brand to support it.
  9. How long we keep it. As stated on the retention page: sessions 30 days, sign in records and brand data while your brand uses the service, backups up to 14 days after a deletion.
  10. Cookies. One cookie keeps you signed in for 30 days and one lasts 10 minutes during sign in. We use no advertising or analytics trackers.
  11. Deleting your data. Email hello@joinsquareup.com from your work address and name your store. We delete within 7 days and reply when it is done. Uninstalling the Shopify app stops every read; we drop the store's data when Shopify asks us to.
  12. Changes. We date every version and email admins before a change that affects them.

How we do it

  1. Change the policy text only in legal-pages.js, on staging first, then promote.
  2. Before any change ships, check it against the Subprocessors and Retention and deletion pages; the three must agree.
  3. Bump UPDATED in legal-pages.js to the day of the change.
  4. A lawyer reviews the first final version and any change to who we share data with.
  5. When a new vendor or a new kind of data enters the code, update this page in the same change.

Numbers

Metric Definition Where measured Status
Policy gaps Things the code does that the page does not say This document, Today 10 on 26 Oct
Days since last review Days since UPDATED legal-pages.js Proposed
Deletion requests Requests per month and days to done hello@ inbox Proposed, see data requests

Open

  1. Who reviews the final policy, and when? Proposal: a lawyer in India who knows the Digital Personal Data Protection Act, before the first brand outside the five partners signs up.
  2. Which laws apply to brands outside India? Cozy is a US store. Proposal: the lawyer confirms whether GDPR and US state laws need extra sections; until then, onboard only Indian brands to production.
  3. Do we need a cookie banner? Proposal: no, while the only cookies are the two sign in cookies and there are no trackers; the lawyer confirms.
  4. Does the policy name the product? The writing rules say no product name on customer pages. Proposal: the policy names the legal entity and says "the service" until the brand name is picked.
  5. Should we keep the Anthropic key on production when nothing uses it? Proposal: remove it, so the subprocessor list stays short and true.
Sources
  • brew/legal-pages.js:5-33, 53
  • brew/auth.js:44-51, 88, 224, 244
  • brew/sessions.js:19-22
  • brew/db/migrations/003_access.sql:2-30
  • brew/server.js:657-666, 1038
  • brew/media.js:27-35
  • brew/jam2/engines.js:7, 60
  • brew/tools/prod-env.sh:9-12
  • brew/public/live.js:341-351
  • brew/SCOPE.md:22-25
  • brew/docs/shopify.app.toml:12-15
  • brew/shopify-app.js:15-19, 30, 203-217
  • memory brew-meta-app-review, brew-access-rules, brew-real-connectors, prod-clean-only, brew-qa-sweep-2026-10-19
  • handbook content/customer-success-and-support/data-requests.md

Source file content/security-privacy-and-legal/privacy-policy.md · For agents: Markdown · JSON