Privacy Policy — Nutrition Maker

Last updated: 2026-06-18

Who we are

Nutrition Maker ("we", "our", "us") is a Shopify app published by Legitimate LLC. Our app lets merchants generate FDA-style US Nutrition Facts and Supplement Facts label panels from nutrition data they enter (labels are formatting aids, not a compliance guarantee — merchants should verify final labels with a qualified expert), stores those labels on the merchant's own Shopify store as metaobjects, and renders a live preview inside the Shopify admin. This Privacy Policy describes what data we collect, how we use it, and the rights you have over it.

Data we collect from merchants who install our app

We collect only what is necessary to operate the service:

Shop identity. Your myshopify.com domain and store name. Used to associate your session with the correct store and to comply with Shopify's mandatory data-deletion (GDPR) webhooks.
Shopify access / session tokens. When you install the app and grant OAuth access, Shopify issues us an access token. We store this token encrypted in our database and use it solely to call the Shopify Admin API on your behalf (for example, to read product titles and to write label metaobjects to your store). Tokens are never transmitted to third parties other than Shopify.
Product references. The Shopify product IDs and titles for products you choose to label. These are stored in our database as a lightweight activity log that powers the in-app label history list.
Nutrition data you enter. Serving size, servings per container, and all nutrient amounts (calories, total fat, saturated fat, trans fat, cholesterol, sodium, total carbohydrate, dietary fiber, total sugars, added sugars, protein, and any micronutrients you declare). This data is stored primarily as an app-owned metaobject on your own Shopify store — you own it and can delete it at any time through Shopify's admin or by uninstalling the app. We also keep a small activity record in our database (timestamp + product reference) so your history list survives reinstalls.

Data we do NOT collect

End-customer / buyer personal data. Nutrition Maker is a merchant-facing tool. We never read, receive, or store any data about your end customers or shoppers.
Behavioral or tracking data. We do not collect IP addresses, browser cookies, device fingerprints, analytics events, or any form of passive user tracking.
Payment information. The app is currently free; no billing or payment data is collected.

How we use the data we collect

We use the data above solely to operate the label editor and storage functionality you installed Nutrition Maker for. Specifically:

Authenticate your Shopify admin session so the app loads securely inside the Shopify admin iframe.
Read your product list so you can select which product to label.
Apply FDA 21 CFR 101.9 rounding and formatting rules to the nutrition values you provide and render a live Nutrition Facts panel preview.
Save the calculated label as a metaobject on your store and display your label history.

We never sell your data. We never use it for advertising. We never share it with third parties except the subprocessors listed below, and only to operate the service.

Subprocessors

We share data with the following processors strictly to operate the service. These are the only third parties we use:

Shopify — platform host, OAuth, and the store where your metaobject label data lives. Shopify's own privacy policy governs data on your store.
Railway — our application hosting provider and managed Postgres database. Activity log records (shop identity, product references, timestamps) are stored in Railway's managed Postgres. Railway encrypts data at rest.

Retention and deletion

Most label data lives on your own store. Because label content is stored as Shopify metaobjects, you can delete it at any time through the Shopify admin or by using the in-app "Remove all data" control — no request to us needed.

Activity log records we hold in our database are kept for the lifetime of your install plus a 30-day reinstall grace window. After 30 days of being uninstalled — or upon receipt of a Shopify shop/redact webhook — we hard-delete every record we hold for your shop from our database.

We automatically honor all three of Shopify's mandatory data-deletion webhooks:

customers/data_request — we respond within 30 days with any buyer-associated data we hold (in practice, none, because we do not collect buyer data).
customers/redact — we delete any customer-associated records we hold within 30 days.
shop/redact — we hard-delete all records for the shop from our database within 30 days.

Your rights (GDPR / CCPA)

Merchants and their personnel have the right to access, correct, export, or delete personal data we hold about them. To exercise any of these rights, email info+support@legitimateapps.com with a description of your request. We will respond within 30 days.

California residents may also have additional rights under the CCPA, including the right to know what categories of personal information we collect, the right to opt out of sale (we do not sell personal information), and the right to non-discrimination for exercising these rights.

Security

All data is transmitted over TLS (HTTPS). Database storage is encrypted at rest by our hosting provider (Railway). Shopify access tokens are stored in encrypted form in our database — they are never logged, never stored in plaintext, and never transmitted outside the Shopify + Railway trust boundary. Every Shopify webhook we receive is HMAC-verified against your app's shared secret; tampered or forged payloads are rejected with a 401 before any processing occurs.

Children's privacy

Nutrition Maker is a merchant tool for food and beverage businesses. It is not directed at children under 13, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will update the "Last updated" date at the top of the page. If you have questions about any changes, contact us at the address below.

Contact

Questions about this privacy policy or requests to exercise your data rights:

info+support@legitimateapps.com
Legitimate LLC — mailing address available on request.