Drilly Mini Cart Drawer — Last updated: July 2026
Progress Bar Pro ("the app") is a Shopify app that adds a cart reward progress bar to a merchant's storefront. This policy explains what data the app collects, why, and how it's handled.
The app stores the merchant's bar configuration — reward tiers, their thresholds and messages, placement and styling — as an app-owned metafield on the Shopify Shop object. It contains no customer data.
The app also stores an OAuth session record (shop domain and access token) required to authenticate API requests to Shopify, in a database hosted on Railway.
When a shopper reaches one of the merchant's reward thresholds and then places an order, the app records one row about that order so it can show the merchant how the bar is performing. That row contains:
The app does not collect, store, or process shopper names, email addresses, postal addresses, phone numbers, payment details, or the contents of an order. The order records described above hold a total and a date and nothing that identifies the shopper. Cart contents shown in the bar are read live from Shopify's Cart AJAX API in the shopper's own browser and are never sent to or stored on our servers.
The bar configuration is used solely to render the progress bar and to create the matching Shopify discounts the merchant asked for. The OAuth session is used solely to authenticate requests to the Shopify Admin API on the merchant's behalf. The order records are used solely to show the merchant the order count and revenue totals on the app's Performance card, and are never shared, sold, or used for any other purpose.
We do not sell, rent, or share any data with third parties. Data is only exchanged with Shopify's own APIs as required for the app to function.
Shop-level metafields and the OAuth session are deleted automatically when the merchant uninstalls the app, in compliance with Shopify's mandatory GDPR webhooks (customers/data_request, customers/redact, shop/redact).
Order records are deleted automatically 400 days after the order date, enforced by the database itself rather than by a scheduled job.
The order records described in section 1 hold no information that identifies a shopper, so there is nothing in them to return in response to a data request. They are still deleted on request: when Shopify sends a customer redaction request, the records for that customer's orders are deleted, and when a shop is redacted, every record for that shop is deleted. Merchants may also contact us at any time to request removal of their shop-level settings.
Questions about this policy can be sent to harshakunchala8@gmail.com.