Wishlist is installed by merchants to let their shoppers save products for later. This page explains what data the app handles.
When a merchant installs the app, we store standard OAuth session data needed to operate the app, and the storefront presentation settings they configure (placement, colors, icon, copy) in a Shopify metafield owned by this app on their shop.
A guest shopper's wishlist is kept only in their own browser (localStorage) and never sent to our servers. Once a shopper is logged in to a customer account and the merchant has connected the customer-sync backend, their saved product and variant IDs are stored against their Shopify customer ID so the list follows them across devices. We do not store names, emails, addresses, or payment details, and a different customer on the same browser never inherits another customer's saved items.
Wishlist responds to Shopify's mandatory customer data request, customer redact, and shop redact webhooks automatically. Uninstalling the app removes its OAuth session data; a shop's saved wishlist data is removed on the shop redact webhook.
Questions about this policy can be sent to support@backhand.dev.