Privacy

The short version

Truewares reads the catalog in your Square account and publishes it to the online stores you connect. To do that we hold a copy of your catalog, the account you sign in with, and the keys to the stores you connected. We use them to run your sync, to show you what it did, and to answer you when you ask us something.

We do not sell your data and we do not advertise. No other shop can see any of it, nothing here is used to train anything, and nothing we hold is written back to Square.

Your account

Email address

How you sign in, and how we reach you about the service. We do not send marketing email.

Your name

Optional. Only the people in your own shop see it.

Password

Stored scrambled. Nobody here can read it or tell you what it is, which is why a forgotten one is reset rather than looked up.

Sign-in sessions

While you are signed in we keep when the session expires, the network address it was created from, and the browser it was created in. That is what lets a session be ended and what makes a sign-in you did not make recognisable.

Your shop

A shop is the workspace your catalog and your connections live in. We hold its name, which plan it is on, and the people you added to it with the role each of them has.

Everything inside a shop belongs to that shop. Nobody outside it can reach any of it, including the people in every other shop on the service.

Your catalog

The bulk of what we hold. Once you connect Square we keep a mirror of the catalog at the locations you chose, and keep it in step as you change things in Square.

Items and variations

Names, descriptions, SKUs, prices and categories, as they are in Square.

Stock

How many of each thing you have, at the locations you chose to sync.

Photos

The address of each photo rather than the photo itself. We fetch one when we publish it and do not keep a copy.

Your own fields

The custom fields you added in Square, mirrored as they are. These often hold supplier names, costs and contact details, so nothing in them is ever sent to a storefront.

What was published

For each item: when it was last sent, what it was sent as, and anything that failed. This is the history the Sync and Changes pages show you.

Nothing here is ever written back to Square, and an item that leaves your Square catalog is marked as gone rather than deleted, so the listing it produced can be taken down rather than orphaned.

The stores you connect

Connecting a store hands us a key to it. Every key is stored encrypted, never as plain text, and is used only for your own shop's sync. Below is exactly what each one lets us do, and the things we deliberately did not ask for.

Square

Read only, and only three things: your item catalog, your stock, and your business name and locations. We never ask for permission to write, so nothing we do can change anything in Square.

Shopify

Read and write your products and their stock, and read your locations. That is publishing. We do not ask for orders, customers, payouts or anything else in your admin.

Etsy

Read and write your listings, and read your shop. We do not ask for your billing, your transactions or your Etsy profile.

Disconnecting a store deletes its key. For a store you connected with a button rather than by pasting a token, disconnecting also uninstalls us from that store's admin.

Support

A ticket you raise is stored with the shop you raised it from. Everyone in that shop who can see tickets can read it, and so can we, because that is how we answer it.

Please do not paste a password or an access token into a ticket. We never need one, and a ticket is the one place in the product where text is kept exactly as you typed it.

Payment

Payments are taken by Stripe, on Stripe's own pages. Card numbers go to them and never to us. What we keep is a reference to your customer record with them, which plan you are on, and whether it is paid.

Cookies

Two cookies, both of them needed to work the product. There is no analytics, no advertising, and no third-party script on any page of the app.

Signing in

Keeps you signed in. It holds a random value rather than anything about you, it cannot be read by script in the page, and signing out deletes it at both ends.

Connecting a store

Set for a few minutes while you are away at Square, Shopify or Etsy approving the connection, and thrown away when you come back. It is what stops somebody else's redirect from attaching a store to your shop.

Your light or dark theme is not a cookie. It is kept by your own browser, on your own machine, and is never sent to us. The marketing site at truewares.com is a different thing and does measure its visitors, which is covered further down.

Who else is involved

The complete list of companies that touch your data, and what each of them is for.

Amazon Web Services

Runs the service and holds the database, in the United States.

Stripe

Takes the payments.

Square, Shopify and Etsy

Your own accounts, reached only with the keys you gave us and only for what is described above.

That is the whole list. We do not sell your data, rent it, or hand it to anybody else, and there is no advertising or analytics company on it.

How long we keep it

Your catalog and its history

For as long as your shop exists. The mirror is what lets a listing be updated or taken down rather than left behind, so it lives as long as the shop does.

Sign-in sessions

Until they expire on their own, or until you sign out, whichever is first.

Store keys

Until you disconnect that store, which deletes them.

An uninstalled Shopify store

Uninstall us from your Shopify admin and Shopify tells us two days later. We then erase that store's keys, its settings, and our record of what we published to it. Your Square catalog and the rest of your shop here are untouched.

Backups

Database backups are kept for seven days and then roll off.

Server logs

Seven days.

Ask us to delete a shop and we delete it: its catalog, its history, its keys and its tickets go with it. Ask us to delete your account and we delete that too.

Keeping it safe

In transit

Everything between your browser and us, and between us and Square, Shopify and Etsy, is encrypted.

Store keys

Encrypted before they are stored, so a copy of the database is not a set of usable keys to anybody's storefront.

Passwords

Scrambled in a way that cannot be undone, so the same is true of them.

Sessions

The database holds a fingerprint of your session rather than the session itself, so a stolen copy of it will not sign anyone in.

One shop at a time

Every question the product asks the database names the shop it is asking about. That is the rule the whole design is built to keep, because a lapse in it is how one shop's catalog would reach another.

No system is perfect. If something goes wrong that affects your data, we will tell you what happened and what we did about it rather than leaving you to find out.

What you can ask for

Whatever your local law entitles you to, we will do for you whether or not it applies where you are.

See it

A copy of what we hold about you and your shop.

Correct it

Your name and email are yours to edit. Your catalog is corrected in Square, and the next sync carries the correction across.

Delete it

Your account, your shop, or both.

Cut us off

Disconnect a store at any time, from the Connections page. Nothing is published after that, and nothing already published is touched.

Ask through Shopify

Shopify passes privacy requests on to the apps a store uses, and we answer them. A request about a shopper has nothing here to answer with: this app reads your catalog and your stock, and is never given access to your orders or your customers.

Ask through Support inside the app, or by email. We answer within thirty days and usually much sooner.

Where it is kept

In the United States, on Amazon Web Services. If your shop is somewhere else, using Truewares means your data is sent to and held in the United States.

The truewares.com website

The site that describes the product is a separate thing from the app you sign in to, and it is the one place we use an outside service to count visitors.

Google Analytics

Runs on truewares.com and sets its own cookies. It is how we see how many people found the site and which parts they read. It does not run anywhere inside the app, on any page.

The waitlist form

Keeps your email address, anything you typed in the note, and the network address, browser and page you came from, which is what tells a real submission from a script. We use it to tell you when we launch, and for nothing else.

Ask us and your place on the waitlist is deleted. A tracking blocker stops the analytics on that site the same as it would anywhere else, and nothing on the site stops working without it.

Children

Truewares is a tool for running a shop. It is not meant for anyone under 16, and we do not knowingly hold anything about one. Tell us if you think we have and it will be deleted.

Changes to this policy

The date at the top is when this page last changed. If a change affects what we do with what we already hold, we will say so in the app before it takes effect rather than quietly editing this page.

Contact

Raise a ticket from Support inside the app, which reaches us with your shop already attached. If you do not have an account, or your question is about an account you no longer have, write to us instead:

privacy.remove-this@truewares.com