Privacy policy

Winky Popups, by Winky. Last updated 11 October 2026.

Winky Popups ("Winky", "we") is a Shopify app that shows popups and prize games on a merchant's online store. This policy explains what information Winky collects when a merchant installs it and when shoppers visit a store that uses it, how we use it, and the choices people have. The data protection terms merchants agree to are in our terms of service.

Information about merchants

When a merchant installs Winky, Shopify gives us, and we keep:

• the store's Shopify address and an access token, so the app can work for that store;
• the campaigns the merchant creates in Winky: their text, colours, games, prizes and display settings.

We read the store's theme, currency and order totals from Shopify when they are needed and do not keep copies of them.

Information about shoppers

Winky does not collect shoppers' names, email addresses, phone numbers, postal addresses or payment details. When a shopper visits a store that uses Winky:

• On the shopper's device, Winky stores a random visitor identifier and a record of which popups were shown and when, so a popup is not shown more often than the merchant chose. This is stored only when the shopper's privacy choices on the store allow it, and is removed when they withdraw that consent.
• On our servers, Winky records that a popup was shown, clicked or played, with the random visitor identifier, the time and the page type. For prize games we record the prize won and the discount code given, so each shopper can play only as often as the merchant allows and can get their code back.
• Orders. When an order comes from a Winky popup (through the popup's button, a prize code, or a Winky link), we record the Shopify order's identifier and which campaign it came from, so the merchant can see what their popups earned. We do not store the order's contents, amount or the customer's details; amounts are read from Shopify when the merchant views their reports.

How we use information

Only to run Winky for the merchant: showing popups to the right shoppers, running prize games fairly, creating discount codes in the merchant's store, reporting results to the merchant, and billing the merchant through Shopify. We do not sell information, use it for advertising, or share it with other merchants.

Sharing

Information is shared only with Shopify, to provide the app, and with Google Cloud, which hosts our servers and database in Singapore. We may disclose information if required by law.

Retention and deletion

When a merchant uninstalls Winky, Shopify asks us to delete the store's data and we erase it, including campaigns, popup activity, prize records and order links. When a shopper asks a merchant to delete their data, Shopify tells us and we delete the order links held for that shopper. Merchants can also contact us to have their data deleted sooner.

Your rights

Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct or delete personal information, or to object to its use. Shoppers can make these requests to the store they shopped with, which will pass them on to us through Shopify, or write to us directly.

Security

All data is sent over encrypted connections (HTTPS). Access to our servers and database is restricted to the people who run Winky.

Changes

If we change how Winky handles information, we will update this page and the date above.

Contact

Questions or requests: ehtashamali414@gmail.com.