RosterSort is a Shopify app that shows a store's customer list sorted by name, finds customer profiles that are likely duplicates (same email, same phone or a very similar name) and lets the merchant merge them. This policy explains what data RosterSort reads, what it keeps and for how long.
Who operates this app
RosterSort is developed and operated by Oussama Elayouchi (Vigil Labs). For any question about this policy or your data: distrimanager2026@gmail.com.
Permissions requested
- read_customers — reads customers (name, email, phone, address, number of orders, amount spent, and for the CSV export tags and note) to show them sorted by name, look for duplicates and produce the export.
- write_customers and write_customer_merge — merge two customer profiles, only when the merchant confirms it in the app. RosterSort doesn't change any other customer data.
Data RosterSort stores
- The store's domain and a technical access token (session), used to call the Shopify API on the store's behalf.
- Scan results: for each likely duplicate pair, the Shopify IDs, names, emails, phone numbers and order counts of both profiles, the reason for the match and the confidence score; plus the date and number of customers scanned.
- Pairs marked "Not a duplicate" (IDs and names of both profiles).
- Merge history: IDs, names, emails and phone numbers of both profiles at the time of the merge, for the merchant’s review and audit trail, subject to erasure requests.
- Store settings: language, theme, sort order, automatic scan frequency, flag on creation and plan.
- Access metadata (verified Shopify actor ID, date, action and route, without search text or tokens), agreement acceptance (version, date and representative), and Shopify data request tracking (customer and request IDs, deadline and status).
The customer list and the CSV export are read live from Shopify each time and aren't stored by RosterSort. RosterSort never accesses payment information.
Hosting and sharing
Data is hosted by Fly.io (European Union, Paris region) on an encrypted volume. It is never sold or used for advertising. Fly.io acts as a hosting subprocessor. RosterSort processes the store's customer data on the merchant's behalf and only for the features described above.
Retention and deletion
- Scan results, merge history and access logs are deleted after 90 days. Names on ignored pairs are cleared after 90 days; minimal pair IDs remain while installed to preserve the merchant’s decision. Completed access requests expire after 90 days. Encrypted backups expire after five days and are not used for normal processing. Restores require subsequent erasure requests to be reapplied before service resumes. The merchant can delete the merge history and restore ignored pairs from the app's Settings at any time.
- When Shopify sends an erasure request for a customer (
customers/redact), all of that customer's data kept by RosterSort is deleted. - All of the store's data is deleted when the
shop/redactwebhook arrives, which Shopify sends 48 hours after the app is uninstalled.
Your rights (GDPR / CCPA)
For a customer data access request (customers/data_request) or any other request about your store's data, write to distrimanager2026@gmail.com. Shopify access requests are tracked in a durable queue with a 30-day response deadline. An export includes only the requesting customer’s stored data; secure delivery must be confirmed separately.
Security
All traffic between RosterSort, Shopify and your browser is encrypted with HTTPS. Access to the Shopify API uses Shopify's OAuth authentication. Application access is logged using the verified Shopify actor, without customer contacts, search text or tokens.
Changes
This policy may be updated as the app or the law changes. The date at the top of this page shows the version in effect.