TrackInbox Privacy Policy

Last updated: 14 October 2026

TrackInbox is a Shopify app operated by Softhopper ("we", "us"). It reads shipping emails from the suppliers a Shopify merchant chooses and adds the tracking numbers to that merchant's Shopify orders. This policy explains what information TrackInbox collects, how we use it, who we share it with, how long we keep it and the choices you have. Contact: info@softhopper.net.

1. Information we collect

• Shopify store information: your shop domain, the plan you chose, and the name and email address of the staff member who opens the app, as provided by Shopify when you sign in.
• Shopify order information: your open orders from the last 60 days (order number, shipping name and postcode, line items with SKU and vendor, existing tracking numbers) and your product vendors.
• Supplier emails: only emails from the supplier sender addresses you configure. We check the sender, subject, date and attachment information first; other emails in your inbox are never downloaded or stored.
• Information extracted from those emails: tracking number, carrier, order reference, SKUs, and the recipient name or postcode if the email contains them.
• Inbox credentials: the inbox password or app password you enter, or the sign-in token from "Sign in with Google" or "Sign in with Microsoft".
• Settings you enter: supplier names, sender filters, review or automatic mode, and the email address for daily summaries.
• Activity log: a record of every email checked, decision made and Shopify update, so you can see and undo what happened.

2. How we use information

• To find supplier shipping emails and extract tracking numbers.
• To match them to your Shopify orders and add fulfillments with tracking. Shopify then notifies your customer. Nothing is posted for a supplier in review mode until you approve it.
• To show you matches, the review queue and the activity log.
• To send the daily summary email, if you turn it on.
• To bill your plan through Shopify, and to provide support.

We do not use your information for advertising, we do not sell it, and we do not send it to AI services or use it to train AI or machine learning models.

3. Google user data

This section applies when you connect a Gmail inbox with "Sign in with Google".

• Scopes requested: https://mail.google.com/, openid, email. https://mail.google.com/ is the permission Gmail requires for mailbox access over IMAP; openid and email tell us which address you connected.
• What we access: the sender, subject, date and attachment information of messages, to find emails from the supplier senders you configured. Only matching messages are downloaded. We never send, change or delete your email.
• How we use it: only to extract the tracking number, carrier and order reference and add them to your Shopify orders, and to show you what was found.
• What we don't do: we do not use Gmail data for advertising, do not sell it, and do not use it to develop, improve or train AI or machine learning models. People at Softhopper do not read your email, except with your permission (for example a support request), for security purposes, or when required by law.
• Storage and security: matching emails and attachments are kept for 30 days. The Google sign-in token is stored encrypted with AES-256-GCM.
• Sharing: Gmail data is only processed by the hosting, database and email delivery providers needed to run TrackInbox, or disclosed when required by law.
• Deletion: remove the inbox under Inbox connections in TrackInbox to delete the stored sign-in token. You can also revoke access at myaccount.google.com/permissions. Email us to delete all data derived from your Gmail.

TrackInbox's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft inboxes connected with "Sign in with Microsoft" are handled the same way, with the IMAP.AccessAsUser.All and offline_access permissions.

4. How we share information

We do not sell, rent or trade your information. It is processed only by the service providers needed to run TrackInbox: our hosting provider, our database provider and our email delivery provider (for daily summaries). Order updates are sent to Shopify, because that is what the app does. We may disclose information when required by law.

5. How long we keep information

• Supplier emails and attachments: 30 days after they arrive.
• Extracted rows and the activity log: while the app is installed.
• Inbox credentials and sign-in tokens: until you remove the inbox or uninstall the app.
• When you uninstall: all data for your shop is deleted when Shopify sends the shop deletion request (48 hours after uninstalling).
• Customer deletion requests from Shopify: the customer's orders and matched rows are deleted.

6. Security

Data is sent over encrypted connections (HTTPS and TLS for mail servers). Inbox passwords and sign-in tokens are encrypted at rest with AES-256-GCM. Access to production systems is limited to the people who operate TrackInbox.

7. Your choices and rights

• Remove a connected inbox at any time under Inbox connections.
• Revoke Google access at myaccount.google.com/permissions or Microsoft access in your Microsoft account settings.
• Uninstall the app to delete all data for your shop.
• Email info@softhopper.net to access, correct or delete your information.

8. Children

TrackInbox is a business tool for Shopify merchants and is not intended for children under 16. We do not knowingly collect information from children.

9. Changes to this policy

We will update the date at the top of this page when this policy changes, and tell merchants in the app about significant changes.

10. Contact

Softhopper – info@softhopper.net. See also our terms of service and the TrackInbox home page.