PO Box Blocker

Privacy

Privacy Policy

Last updated September 30, 2026

This policy explains what information PO Box Blocker uses, why it is needed, and how merchants can request its removal. The app is designed to check delivery addresses at checkout without storing customer address details.

Information we process

  • Shop and app records. We store the Shopify shop name and domain, installation status and dates, and the ID of the shop's checkout validation so the app can show store history and manage its settings.
  • Shopify login sessions. The app stores Shopify session information and access tokens needed to authenticate Admin API requests and update the shop's validation settings.
  • Checkout settings. The enabled state and custom message shown when an address is blocked are managed on Shopify's checkout validation. The app uses the setting to return the merchant's chosen message at checkout.
  • Custom blocking phrases. When a merchant adds a phrase, we store the phrase and its shop domain in our database and private dashboard. We use these submissions to see which terms merchants commonly need and consider them for future defaults. We do not receive checkout address text through this feature.
  • Support chat. The in-app chat is provided by Crisp. When the chat widget loads, Crisp may process technical and session data. Crisp processes messages and any contact details a merchant chooses to share to provide support. See Crisp's Privacy Statement and Cookie Policy.

Checkout addresses: Shopify runs the validation function during checkout. It checks address lines 1 and 2 for common PO Box formats and reads the selected delivery method. The function does not send address text to the PO Box Blocker server or save it in the app's database.

How we use information

We use shop and session information to authenticate the merchant, provide the app, save settings, show installation history, review custom phrase suggestions, and respond to support or privacy requests. We do not sell personal information or use it for targeted advertising.

Service providers

Shopify provides app authentication, the Admin API, and the checkout validation runtime. Railway hosts the app and its database. Crisp provides the in-app support chat. These providers process information as needed to operate their services. We do not share app data with advertising or data-broker services.

Retention and deletion

Shopify session credentials are removed when the app receives an uninstall event. Shop installation history remains available after uninstall. Custom phrase submissions remain linked to the shop for aggregate suggestions until a Shopify shop-redaction request is received, when those submissions are deleted. We also record the request so an operator can review the shop's remaining records. Merchants can request deletion of other information by contacting us; we will review and remove associated records where applicable.

Your choices

Merchants can uninstall the app from Shopify to stop its access to the shop. To ask questions or request access, correction, or deletion of information associated with a shop, use the support contact provided in the Shopify App Store listing.

Changes to this policy

We may update this policy when the app or its data practices change. The latest version and its effective date will be posted on this page.