Privacy Policy

Effective November 6, 2026

Molt is a Shopify app that backs up a customized theme and carries its customizations into new releases of that theme. This policy explains what Molt collects, what it does with it, who processes it, how long it is kept, and the rights you have over it.

1. Who we are and who this covers

Hunni Development ("we," "us") makes Molt. This policy covers merchants and staff who install or use the app, visitors to the Molt website, and anyone who contacts us about it.

It does not cover the shoppers who visit your store. Molt does not ask Shopify for customer or order permissions, and it collects nothing from your shoppers' visits, carts, orders or checkout. It adds no tracking scripts, cookies or pixels to your theme.

For the theme data the app handles on your instructions, you are the controller and we act as your processor. For your account with us and your correspondence with us, we are the controller.

2. What we collect

From Shopify, when you install the app

  • Your store's myshopify domain and name.
  • An access token and a refresh token for the permissions you approve: read_themes and write_themes.
  • The email address on your store, which we read to address release alerts.

While the app runs

  • Full copies of your themes. A backup, and the check behind the customizations page, read every file of the theme you choose: code, settings, section content, wording and assets. We keep those copies so you can restore them and compare them with new releases.
  • Upgraded themes. When you prepare an upgrade, we keep the merged theme we built, with a record of what happened to each file.
  • Screenshots of your storefront. To compare your theme with an upgrade, our servers open a set of your storefront pages in a browser, the way a logged-out visitor would, and keep a screenshot of each. If a public page shows a person's details, such as a reviewer's name, a screenshot can include them.
  • Your storefront password, if your store has one and you enter it. This is the password shoppers type on your password page, not your Shopify password. We store it encrypted and use it only to open your storefront for page comparisons. You can remove it from an upgrade's page at any time.
  • Descriptions of your customizations. The list of changes your team made to the theme, in plain words, and the code they touch.
  • Release alerts. The emails we write you, with your store's name, your store's email address and the customizations they mention, and your choice to turn alerts on or off.
  • Your GitHub repository, if you connect one. You connect through Molt's GitHub App and choose the repositories on GitHub. We keep the names and branches of the repositories you can use, and the ID of Molt's installation on your GitHub account. We don't keep a GitHub password or a GitHub token for your account. When Molt needs a repository, GitHub gives it a key that lasts one hour and works only on that repository. To open a pull request we download the branch, merge it, and delete the download when the job ends. The merged theme and a record of the job are kept like any other upgrade.
  • Agency links, if you make one. If you enter an agency's code, we record which agency's Molt account your store is linked to and when. That agency can then see your store's theme name and version, the list of customizations and the upgrades you published. You or the agency can remove the link at any time.
  • Your plan. Shopify tells us which plan your store is on, and we tell Shopify when a billable upgrade or extra store needs charging. We don't see your card details.
  • Activity records. The backups, upgrades, restores and removals you run, when they ran and how they ended.
  • Operational logs. Request times, store domains, job identifiers and error details.

From you

  • What you send us when you email us or ask for support.

What we do not collect

  • Payment card details. Shopify bills you, and we never see your card.
  • Your Shopify password. You sign in through Shopify.
  • Data about your shoppers, their carts, their orders or checkout.

3. How we use it

  • To provide the app: back up and restore themes, work out what your team customized, merge those changes into new releases, compare the result with your live theme, and publish or roll back when you ask.
  • To tell you when a new release of your live theme comes out. You can turn these emails off on the Themes page in the app.
  • To bill you for the plan you chose, through Shopify.
  • To support you and look into problems you report.
  • To keep the app running and secure, and to comply with the law.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use your theme code to train machine-learning models, and we do not allow our providers to.

4. Artificial-intelligence processing

Some steps send theme code to a third-party AI model provider:

  • Merging overlapping edits. When your team and the theme's maker changed the same lines of a file, we send that file whole: the original release, your version and the new release, with the theme's name and version numbers.
  • Naming your customizations. For each customization we send a short technical label, the names of the files involved and up to 40 added lines per file.

The provider processes this as our processor, through its commercial API. Its commercial terms do not allow it to train models on this material, and it keeps inputs and outputs only for the limited time those terms allow. Everything the model merges goes into a draft theme, with a written explanation of what it did. Nothing it produces reaches your live theme unless you publish it.

5. Who processes data for us

  • Shopify: the platform, sign-in, billing, and the Admin API the app uses to read and write your themes.
  • Hosting: runs the app and its background jobs, and stores the data described above.
  • An AI model provider: as described in section 4.
  • Email delivery: sends release alerts.
  • GitHub: if you connect a repository, it holds your code and the pull requests Molt opens, under your own GitHub account.

Email support@hunni.dev for the current list of providers by name. We do not transfer your data to anyone else except as this policy describes, in connection with a merger, acquisition or sale of the business (in which case this policy continues to apply), or where the law requires it.

6. Where data is stored

We store data in the United States, on an encrypted disk. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States. For those transfers we rely on the Standard Contractual Clauses and the UK Addendum in our providers' data processing terms, and on a provider's certification under the EU-U.S. Data Privacy Framework where it holds one. Merchants can ask us for a data processing agreement.

7. How long we keep it

While the app is installed

Theme copies, upgraded themes, screenshots, customization lists, alerts and activity records are kept while the app is installed, so that restore and the upgrade record keep working.

After you uninstall

  • Access and refresh tokens: deleted as soon as Shopify tells us the app was uninstalled. Release alerts stop at the same moment.
  • Everything else about your store: deleted when Shopify sends its shop/redact request, about 48 hours after you uninstall. If you reinstall before then, we keep your data.
  • That includes your backups, so restore anything you want to keep before you uninstall.
  • Agency links and your storefront password are deleted as soon as Shopify tells us the app was uninstalled.
  • Your GitHub connection is deleted when you uninstall Molt, or at once if you disconnect the repository. Pull requests Molt opened stay in your repository. Uninstalling Molt from Shopify leaves the GitHub App on your GitHub account, and you can remove it from your GitHub settings at any time.
  • Themes already on your store, including drafts Molt created, stay on your store. Remove any you don't want before you uninstall, or from Shopify's themes page.
  • If you want your store's data deleted sooner, email us.

Other records

  • A record that we handled each privacy request: the store's domain, the kind of request, what we did and when, with counts of what was deleted. We keep it to show the request was honored.
  • Operational logs: up to 30 days.
  • Support correspondence: up to 3 years.
  • Deleted data can remain in our disk snapshots for up to 5 days, until those snapshots expire.

The app subscribes to Shopify's compliance webhooks. On shop/redact we delete everything associated with the store, unless the app has been reinstalled on that store in the meantime. The customers/data_request and customers/redact requests are acknowledged and logged. We hold no customer data, so there is nothing to return or erase.

8. Security

Data travels over encrypted connections (TLS) between your browser, Shopify, our servers and our providers. The app reaches your store through scoped tokens from Shopify, which you can revoke by uninstalling. Screenshots and email previews open only through links signed for your store. Access to our systems is limited to the people who need it. No system is perfectly secure. If a breach affects your data, we will notify you, Shopify and any authority the law requires, without undue delay.

9. Your rights

Depending on where you are, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy in a portable form, to object to or restrict certain processing, to withdraw consent where processing rests on consent, and to complain to a supervisory authority. Uninstalling the app deletes your store's data on the schedule above. For anything else, email support@hunni.dev. We respond within 30 days, or sooner where the law requires, and we may ask you to confirm that you control the store or email address concerned.

If you are a California resident: we do not sell or share personal information, and we will not discriminate against you for exercising your rights.

If you are in the European Economic Area or the United Kingdom: our lawful bases are performance of our contract with you, our legitimate interests in securing and improving the app, and compliance with legal obligations. We do not make decisions about you by automated means that produce legal or similarly significant effects.

10. Cookies

Inside the Shopify admin, the app uses Shopify's session tokens to know which store you are working in. It sets no analytics or advertising cookies. The Molt website sets no cookies, and its host keeps ordinary request logs.

11. Children

The app is for businesses and is not directed to anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email support@hunni.dev and we will delete it.

12. Changes to this policy

We may update this policy. The effective date at the top changes when we do, and for material changes we will notify merchants through the app or by email before they take effect.

13. Contact

Hunni Development, maker of Molt. Mailing address: 99 Wall Street #2084, New York, NY 10005, United States. Privacy questions and requests: support@hunni.dev.