{
 "id": "9.1",
 "title": "Privacy policy",
 "department": "Security, privacy and legal",
 "department_slug": "security-privacy-and-legal",
 "direction": null,
 "branded": false,
 "status": "draft",
 "owner": "Param",
 "last_verified": "Mon Oct 26",
 "holds": "The final policy, in plain words",
 "urls": {
  "html": "https://handbook.joinsquareup.com/security-privacy-and-legal/privacy-policy",
  "markdown": "https://handbook.joinsquareup.com/security-privacy-and-legal/privacy-policy.md",
  "json": "https://handbook.joinsquareup.com/security-privacy-and-legal/privacy-policy.json"
 },
 "other_directions": [],
 "tldr": {
  "headline": "Our privacy page is a short preview, and the code does more",
  "points": [
   {
    "icon": "warn",
    "text": "Ten things the code does are missing from the page, like OpenAI and Higgsfield receiving data."
   },
   {
    "icon": "lock",
    "text": "Shopify customer names, emails, phones and addresses are never read; only totals are kept."
   },
   {
    "icon": "book",
    "text": "A 12-point plain-words final policy is drafted, naming Yellow Monk Technologies LLP."
   },
   {
    "icon": "flag",
    "text": "Meta's app settings still point the privacy URL at staging."
   },
   {
    "icon": "people",
    "text": "A lawyer must review the final policy before the product opens to everyone."
   }
  ],
  "stat": {
   "value": "10",
   "label": "policy gaps on 26 Oct"
  },
  "decide": "Who reviews the final policy, and before which brand signs up outside the five partners?",
  "mood": "waiting"
 },
 "sources": [
  "brew/legal-pages.js:5-33, 53",
  "brew/auth.js:44-51, 88, 224, 244",
  "brew/sessions.js:19-22",
  "brew/db/migrations/003_access.sql:2-30",
  "brew/server.js:657-666, 1038",
  "brew/media.js:27-35",
  "brew/jam2/engines.js:7, 60",
  "brew/tools/prod-env.sh:9-12",
  "brew/public/live.js:341-351",
  "brew/SCOPE.md:22-25",
  "brew/docs/shopify.app.toml:12-15",
  "brew/shopify-app.js:15-19, 30, 203-217",
  "memory brew-meta-app-review, brew-access-rules, brew-real-connectors, prod-clean-only, brew-qa-sweep-2026-10-19",
  "handbook content/customer-success-and-support/data-requests.md"
 ],
 "open_questions": [
  "**Who reviews the final policy, and when?** Proposal: a lawyer in India who knows the Digital Personal Data Protection Act, before the first brand outside the five partners signs up.",
  "**Which laws apply to brands outside India?** Cozy is a US store. Proposal: the lawyer confirms whether GDPR and US state laws need extra sections; until then, onboard only Indian brands to production.",
  "**Do we need a cookie banner?** Proposal: no, while the only cookies are the two sign in cookies and there are no trackers; the lawyer confirms.",
  "**Does the policy name the product?** The writing rules say no product name on customer pages. Proposal: the policy names the legal entity and says \"the service\" until the brand name is picked.",
  "**Should we keep the Anthropic key on production when nothing uses it?** Proposal: remove it, so the subprocessor list stays short and true."
 ],
 "parts": {
  "Answer": "The privacy page today is a short preview policy dated 19 October 2026; this document lists what it says, where the code does more than it says, and the proposed final policy in plain words that a lawyer must review before the product opens to everyone.",
  "Today": "### What the page says\n\n| Section | What it says | Source |\n|---|---|---|\n| Label | Preview policy, updated 19 October 2026, served at `/privacy` on every site | [src: brew/legal-pages.js:6, 18, 53] |\n| Status | A design partner preview; a full policy comes before opening to everyone | [src: brew/legal-pages.js:19] |\n| What is read | The store's public site, public reviews, rivals' public sites, ads in Meta's public Ad Library, what AI assistants answer about the category | [src: brew/legal-pages.js:21] |\n| Connected accounts | Only if the team connects them; read only; keys encrypted; only the team sees the numbers; Slack posts only to the picked channel | [src: brew/legal-pages.js:23] |\n| Shopify | Reads products, stock, orders and how many orders each customer placed; never names, emails, phones or addresses; keeps totals only; uninstall stops every read; honours Shopify's data and erasure requests | [src: brew/legal-pages.js:25] |\n| Sign in | Google gives name, email address and photo; inside Shopify, Shopify signs the person in | [src: brew/legal-pages.js:27] |\n| Where it is kept | Google Cloud; AI models on Google Cloud; public data through data providers; finals by Sloosh; email through Resend | [src: brew/legal-pages.js:29] |\n| Who sees what | The team sees the feed, jams and connected numbers; anyone else only what is public | [src: brew/legal-pages.js:31] |\n| Deleting | Email hello@joinsquareup.com from the work address naming the store; we delete the read, Plays, jams and connected keys and reply; no time given | [src: brew/legal-pages.js:33] |\n| Contact | hello@joinsquareup.com | [src: brew/legal-pages.js:5] |\n\n### What the code does that the page does not say\n\n- OpenAI receives voice notes for transcription, and photos and prompts for image edits, images and speech. [src: brew/server.js:1038] [src: brew/media.js:27-35]\n- Higgsfield receives prompts and pictures when its keys exist on production. [src: brew/jam2/engines.js:7, 60] [src: brew/tools/prod-env.sh:12]\n- The Anthropic key is mounted on production while text runs on Gemini through Vertex. [src: brew/tools/prod-env.sh:9-10]\n- Every signed in email that opens a brand is logged with how it got in: brew, team, official or blocked. [src: brew/server.js:657-666] [src: brew/db/migrations/003_access.sql:19-29] [src: memory brew-access-rules]\n- Each sign in writes a session row with the email and the browser's user agent; an IP column exists but sign in does not fill it. [src: brew/sessions.js:19-22] [src: brew/auth.js:88]\n- Cookies: `fs_s`, the session, 30 days; `fs_g`, the sign in handshake, 10 minutes. [src: brew/auth.js:224, 244]\n- Teams upload notes, files and photos into brand memory and References. [src: brew/SCOPE.md:22-23]\n- Team email is sent: invites, joins, view changes, Plays ready and a weekly digest. [src: brew/SCOPE.md:25]\n- The Delete my data sheet promises 7 days; the page gives no time. [src: brew/public/live.js:348-351] [src: brew/legal-pages.js:33]\n- Shopify's three compliance webhooks are handled: no per customer record to send or erase; `shop/redact` drops the store's token and numbers. [src: brew/shopify-app.js:15-19, 30, 203-217]\n\n### Problems with the page as written\n\n- It names no legal entity, no address, no retention periods and no legal basis. [src: brew/legal-pages.js:18-33]\n- It uses the product name and the old word for Plays, and names the company behind Sloosh, against the writing rules for anything a customer reads. [src: brew/legal-pages.js:29-31]\n- Meta's app settings point the privacy and data deletion URLs at the staging site, brew.joinsquareup.com/privacy. [src: memory brew-meta-app-review]\n- A cookie banner was left open by decision on 19 Oct. [src: memory brew-qa-sweep-2026-10-19]",
  "Tomorrow": "| Item | Version | Tag |\n|---|---|---|\n| The final policy below replaces the preview page, after a lawyer's review | v1 | Changes |\n| Name Yellow Monk Technologies LLP as the controller, with a postal address | v1 | New |\n| State every subprocessor, matching the Subprocessors page | v1 | Changes |\n| State retention periods, matching Retention and deletion | v1 | New |\n| State the 7 day deletion promise the sheet already makes | v1 | Changes |\n| Point Meta, Shopify and Google at production's privacy URL | v1 | Changes |\n| Add what posting and scheduling read and write when v2 adds them | v2 | Changes |\n| Add how results are measured and what is kept when v3 adds them | v3 | Changes |\n\n### The proposed final policy, in plain words\n\nThis is a draft for Param and a lawyer. It is not legal advice.\n\n1. **Who we are.** The service is run by Yellow Monk Technologies LLP, India. Write to hello@joinsquareup.com about anything on this page. Address to add.\n2. **What we read about your store.** Your public website, products and prices, public reviews, your rivals' public sites, public ads in ad libraries, public posts and threads about your category, and what AI assistants answer when shoppers ask about it.\n3. **Accounts you connect.** Only the ones your team connects: Shopify, Meta Ads, Google Ads, Google Analytics, Klaviyo, Judge.me and Slack. Access is read only. We never change your accounts. Keys are encrypted and never shown in a page or a log. Only your team sees the numbers.\n4. **Your store's customers.** From Shopify we read order totals, dates and how many orders each customer placed. We never read customers' names, emails, phones or addresses, and we keep totals, never a record of one customer.\n5. **About you.** When you sign in with Google we get your name, email address and photo. We keep a record of each sign in with your browser type, and of which brands your email opened, so we can end sessions and keep brand data with the brand's own people.\n6. **What your team adds.** Notes, files, photos and messages your team adds in jams, memory and References stay with your brand.\n7. **Who helps us.** Google Cloud stores the data and runs most of the AI. OpenAI and Higgsfield make some pictures, voice and transcripts. Sloosh makes finals your team pays for. Resend sends our emails. Data providers fetch public data. The full list is on our subprocessors page.\n8. **Who sees what.** Your team sees your feed, Plays, jams and connected numbers. Anyone else sees only public data, and not even that while your store is still behind Shopify's password page. Our own staff can open every brand to support it.\n9. **How long we keep it.** As stated on the retention page: sessions 30 days, sign in records and brand data while your brand uses the service, backups up to 14 days after a deletion.\n10. **Cookies.** One cookie keeps you signed in for 30 days and one lasts 10 minutes during sign in. We use no advertising or analytics trackers.\n11. **Deleting your data.** Email hello@joinsquareup.com from your work address and name your store. We delete within 7 days and reply when it is done. Uninstalling the Shopify app stops every read; we drop the store's data when Shopify asks us to.\n12. **Changes.** We date every version and email admins before a change that affects them.",
  "How we do it": "1. Change the policy text only in `legal-pages.js`, on staging first, then promote.\n2. Before any change ships, check it against the Subprocessors and Retention and deletion pages; the three must agree.\n3. Bump `UPDATED` in `legal-pages.js` to the day of the change.\n4. A lawyer reviews the first final version and any change to who we share data with.\n5. When a new vendor or a new kind of data enters the code, update this page in the same change.",
  "Numbers": "| Metric | Definition | Where measured | Status |\n|---|---|---|---|\n| Policy gaps | Things the code does that the page does not say | This document, Today | 10 on 26 Oct |\n| Days since last review | Days since `UPDATED` | `legal-pages.js` | Proposed |\n| Deletion requests | Requests per month and days to done | hello@ inbox | Proposed, see data requests |",
  "Open": "1. **Who reviews the final policy, and when?** Proposal: a lawyer in India who knows the Digital Personal Data Protection Act, before the first brand outside the five partners signs up.\n2. **Which laws apply to brands outside India?** Cozy is a US store. Proposal: the lawyer confirms whether GDPR and US state laws need extra sections; until then, onboard only Indian brands to production.\n3. **Do we need a cookie banner?** Proposal: no, while the only cookies are the two sign in cookies and there are no trackers; the lawyer confirms.\n4. **Does the policy name the product?** The writing rules say no product name on customer pages. Proposal: the policy names the legal entity and says \"the service\" until the brand name is picked.\n5. **Should we keep the Anthropic key on production when nothing uses it?** Proposal: remove it, so the subprocessor list stays short and true."
 }
}