Privacy policy — Nooko Payment Rules

Effective date: November 6, 2026

Nooko Payment Rules ("the app") is a Shopify app developed by Nooko. It lets merchants hide, rename and reorder the payment methods shown at checkout. This policy explains what data the app accesses, what it stores and how that data is deleted.

Data the app stores

When a merchant installs the app, it stores one session per store in a database hosted on Cloudflare D1. The session contains:

the store's myshopify.com domain;
the access tokens Shopify issues to the app, and their expiry dates;
the permission granted to the app (write_payment_customizations).

The app does not store names, email addresses or any other information about the store's staff or customers.

The rules a merchant creates are not stored on our servers. They are saved in the merchant's own store, as metafields of the app's payment customization.

Data read at checkout

The rules run as a Shopify Function on Shopify's infrastructure during checkout. To evaluate the merchant's rules, the function reads:

the country code and province code of the delivery address (never the street, postal code, name, email or phone number);
the cart total and its currency;
the product type, vendor, tags and collections of the products in the cart;
whether the customer has a tag the merchant used in a rule (yes or no only; not the customer's identity or other tags);
the selected delivery method;
the names of the available payment methods.

This data is processed by Shopify to decide which payment methods to show. It is not sent to our servers and the app does not store it.

Billing

Subscriptions are handled by Shopify. To know which plan a store is on, the app asks Shopify for the store's active subscription each time the app is opened. The app does not store payment details.

Service providers

Shopify — platform, checkout and billing.
Cloudflare — hosting of the app and its database. Cloudflare processes technical request data, such as IP addresses, to deliver the service. Our server logs may contain the store's domain and the name of the event being processed, and are kept only for a short time.

We do not sell, rent or share data with anyone else, and we do not use it for advertising.

Deletion

When a merchant uninstalls the app, its session is deleted from our database immediately.
When Shopify sends the shop data erasure request (48 hours after uninstalling), the deletion is repeated.
On uninstall, Shopify removes the app's payment customization and its metafields, including the rules.
Because the app stores no customer data, customer data requests and customer erasure requests have nothing to return or delete.

Changes

If this policy changes, the new version will be published on this page with a new effective date.

Contact

For questions about this policy or your data, write to nooko.apps@gmail.com.