Save Submissions
Privacy policy
Save Submissions keeps a copy of contact-form entries so a store can search, export, and manage them in the Shopify admin. Shopify’s own contact form, thank-you message, and notification email keep working. This policy says what is stored, who can see it, and when it is deleted.
From the form
The fields a visitor fills in, files they attach, the page they were on, the time, their IP address, and their browser.
From the store
The shop address, the keys that keep the app installed, the store name, email, and time zone, and the settings you choose.
Your controls
Trash, permanent delete, automatic deletion, and Erase store data are in the app. The weekly email is counts only, and it is on until you turn it off.
Privacy requests
A Shopify customer request is matched by email or phone. A deletion request removes the matching submissions and their files.
1. Who this covers
This policy is for two groups. Merchants install the app and decide what their forms ask for. Visitors are the people who submit those forms.
You, the merchant, decide to collect that information and are responsible for the notice on your store. We store and display it so the app can do its job. We are not Shopify. Shopify still receives the original contact form on your store.
The app is not aimed at children. Do not use it to knowingly collect information from children.
2. Form submissions
Recording starts when the Save Submissions theme app embed is on for that theme. A form is saved when it is a Shopify contact form: its action ends in /contact, it sends form_type=contact, or it uses contact[…] fields. A custom form can opt in by adding data-ss-enable-submission set to that store’s myshopify.com domain.
For each saved submission we store:
- Name, email, phone, message, and every other field on the form
- The storefront page URL and the form’s action address
- The date and time
- The visitor’s IP address, which is shown on the submission in the app
- The browser user agent, stored with the submission for spam and security checks
- Whether it was marked spam, and the reason
- A plain-text copy of the fields so search can find them
- Email addresses and phone numbers found in the fields, indexed so a privacy request can match them exactly
These forms are left alone: cart, checkout, account, search, localization, Shopify Forms embeds, and the captcha form. A form with tracking switched off is left alone as well.
Spam handling
| Signal | What we keep |
|---|---|
| Hidden honeypot field is filled in | Nothing. The submission is dropped. |
| Sent in under 2 seconds, more than 2 links in the message, a blocklisted phrase, a disposable email domain, or more than 20 submissions from the same IP on the same form within 5 minutes | The submission is saved and marked spam, with the reason. |
| More than 40 submissions from the same IP on the same form within 5 minutes | Those later attempts are not saved. That IP is blocked on that form for 24 hours. The block record holds the IP address until the 24 hours end. |
3. Files
A submission can include up to 8 files, 2 MB each. Allowed types are PDF, common images (SVG is refused), Word, Excel, PowerPoint, OpenDocument text and spreadsheets, TXT, CSV, RTF, ZIP, HEIC, and TIFF. There is no separate storage cap per store. The per-file limit still applies.
Each file is stored on the app server under a random name. The upload folder has no directory listing, and script files are not served from it. Anyone who has the file link can open that file. The link can appear in the app, in an export, on a Live Sheet, and in Shopify’s contact notification email, because the app adds the link to the form before that email is sent.
A file that no submission points to is deleted after 24 hours.
4. Store and account
When you install the app we store:
- Your shop domain
- The access token and refresh token Shopify issues, so the app can stay installed. The only permission requested is
write_app_proxy, for the storefront app proxy. The app does not request orders, products, or your customer list. - Store name, store email, and time zone, read from Shopify, so the weekly summary and privacy-request emails can be addressed and timed
- Settings: weekly summary on or off (on until you turn it off), automatic deletion on or off (off until you turn it on), and the number of days (1 to 3650, starting at 90)
Contact us sends us your name, email, phone, message, and an optional screenshot (PNG, JPG, GIF, or WebP, up to 5 MB). From inside the app it also sends the shop. That message is emailed to us. It is not kept as a mailbox inside the app. A short rate-limit row stores the store when you are signed in, the IP address, and the time, and is removed after 2 days. You can send up to 6 messages in an hour.
The admin screen loads the Inter typeface from Google Fonts, icons from jsDelivr, and a file-preview library from Fancyapps, in your browser, while the app is open. The storefront embed does not load those services. These public policy pages use your device’s own fonts and do not call those services.
The embedded app does not use cookies or the browser’s local storage. Each page is checked with Shopify’s signed parameters or a short-lived session token from Shopify. The storefront embed does not set its own cookie.
5. How it is used
- Show submissions in Inbox, Spam, and Trash, with search and filters
- Export a CSV, or a ZIP with one CSV per form. Exports include the form fields, page URL, and spam flag. They do not include IP address or user agent.
- Open a Live Sheet when you create one
- Send the weekly summary: counts of submissions, files, forms used, and spam flags, plus the name of the busiest form. It does not include message text, email addresses, or phone numbers. It goes out on Monday morning in the store’s time zone, to the store email, until you turn it off in Settings.
- Run the spam checks and the 24-hour block
- Answer Shopify’s privacy webhooks
- Deliver a support message you chose to send
- Keep the installation limited to that one store
We do not sell personal information, and we do not use it for advertising.
6. Who can see it
- People who can open the app in that store’s Shopify admin
- Anyone you send an export to
- Anyone who has a Live Sheet link you created. The sheet shows up to 2,000 rows: time, name, email, phone, page URL, and custom fields. It does not show IP address or user agent. It is read-only, refreshes about every 5 minutes, and is marked so search engines should skip it. One link per store is active. You choose 24 hours, 7 days, or 30 days, and you can revoke it at any time.
- Shopify, which already receives the contact form. File links may be included in Shopify’s notification email.
- The store email inbox, for the weekly counts and for a copy of submissions that match a customer data request
- Our inbox, for a support message you send from the app or from this page
A Live Sheet link and a file link are secrets only for as long as they stay private. Treat them like a password once you share them.
7. How long it is kept
| Data | Retention |
|---|---|
| Submissions and their files | Until you delete them, automatic deletion removes them, a privacy deletion runs, or the store’s data is erased. Automatic deletion stays off until you enable it. The period is 1 to 3650 days, and the field starts at 90. |
| Trash | Stays until you restore it or delete it permanently. |
| After uninstall | Access tokens are removed and the app is marked inactive. Submissions, files, and the store record are deleted after 45 days, or after the period configured for this installation, which will not be longer than 365 days. Installing again before that date restores access to the same data. |
| Shopify shop redact | Everything for that store, including the store record, is deleted when Shopify sends the request. |
| Shopify customer redact | Submissions that match the customer’s email or phone, and their files, are deleted. |
| Erase store data | Submissions, forms, files, and the Live Sheet link are deleted immediately. The app stays installed. The screen asks you to type a confirmation phrase. |
| Unattached upload files | Deleted after 24 hours. |
| IP block after the 40-submission limit | 24 hours. |
| Rate-limit counters | 2 days. |
| Webhook delivery logs | 30 days. A customer data-request log records the shop, whether an email or phone was present, and how many submissions matched. It is not a second copy of the form. |
| Expired or revoked Live Sheet links | Removed 90 days after they expire or are revoked. |
8. Privacy requests
A visitor should contact the store. From the app you can search, export, and delete.
If the visitor uses Shopify’s customer privacy tools, we handle the webhook Shopify sends:
- Data request. Matching submissions are emailed to the store’s email address, including the fields and the IP address stored on those rows. That copy is not sent to anyone else.
- Customer redact. Matching submissions and their files are deleted.
- Shop redact. The store’s app data is deleted.
Erase store data, in Settings, removes submissions, forms, files, and the Live Sheet link immediately. The app stays installed.
9. Security
Each store’s rows are queried only for that store. Admin pages are checked by Shopify on each load, without an app cookie. Upload names are random, SVG files are refused, and the upload folder does not run scripts. Live Sheet links are long, they expire, and you can revoke them.
No storage setup is immune to every risk. Keep Shopify staff access, exports, and Live Sheet links limited to people who should see customer messages.
10. Changes
When this policy changes, the date at the top of this page changes with it. The page you are reading is the current one. How the app may change is covered in the Terms and conditions.
11. Contact
Merchants can use Contact us inside the app or on this page. Visitors should contact the store that received the form. That store can find the message, export it, or delete it.
Common questions are on the FAQs.