YeahBadges privacy policy

Last updated: October 20, 2026

YeahBadges is an app for Shopify stores. It shows trust badges, icons, payment logos and official store badges on product pages, the cart page and the cart drawer. This policy explains which data YeahBadges processes when a merchant installs and uses the app, and when shoppers visit a store that shows YeahBadges badges.

Who is responsible

YeahForge

Contact: support@yeahforge.com

Summary

• Your badge settings are stored in your Shopify store, not on our server.
• Our server keeps counts of badge views and clicks for each store, together with the store's plan and subscription status.
• If your store is password protected and you enter its storefront password for the preview, our server uses it only to load your own store pages. It stores the password, encrypted, only if you choose to remember it; otherwise it holds it in memory for at most six hours. You can forget a stored password at any time in the YeahBadges admin.
• If you turn on sales after badges, a Shopify web pixel counts orders placed after a shopper saw a badge. Shopify runs it only when the shopper allows analytics. Our server keeps daily totals per badge.
• The app stores one email address: your store's contact email in Shopify, to send you email notices about failing badges and your monthly views. You can turn the notices off in the app, which also deletes the address. It does not store names, other email addresses, IP addresses, order IDs, product IDs or payment details.
• YeahBadges does not set cookies. It adds a web pixel to your store only when you turn on sales after badges.
• When you uninstall YeahBadges, the data on our server is deleted.

Access to your store

When you install YeahBadges, you allow it to:

• Read products (read_products): to choose products and collections for a badge and to suggest icons that match your product types.
• Read store languages (read_locales): to list the languages your store publishes, so you can translate badge texts.

Only when you turn on a feature that needs more access, YeahBadges asks for it, and you can decline:

• Write pixels and read customer events (write_pixels, read_customer_events): when you turn on sales after badges in Analytics, to add YeahBadges's web pixel to your store and to remove it when you turn the feature off.
• Read store policies (read_legal_policies): when you allow it in the claim check of a badge, to read the return window of your Shopify return rules and compare it with the return days in your badge texts.

YeahBadges does not request access to your customer records or orders.

Data stored in your Shopify store

YeahBadges saves your badges as app data in your store (the app metafield badge_studio.configuration). This includes badge names and texts, icons, colors and layout, placement and targeting rules (such as selected products and collections, product tags, customer tags and countries), schedules, translations and images you upload. Your theme reads this data to show the badges. Editor preferences, such as favorite icons, recently used icons and dismissed tips, are saved the same way (badge_studio.preferences).

Shopify hosts this data and deletes it when you uninstall the app.

For the checkout block "YeahBadges trust badges", YeahBadges keeps a copy of the active badges that can show at checkout in a second app metafield of your store (checkout_badges, owned by YeahBadges): their texts, translations, schedules and countries, a checkout icon for each icon and the payment logos. The copy contains no personal data. The block shows it with checkout's own icons, loads nothing from our server and uses only the buyer's language and country to pick the texts and apply the country rules. After you uninstall YeahBadges, Shopify deletes this copy as well; it may keep it for a short time first.

Data in your browser

The YeahBadges admin keeps a few items in your browser's local storage: unsaved changes as a draft (removed when you save or discard them; drafts older than seven days are removed the next time you open YeahBadges), recently used icons, favorites until they are saved in your store, and display preferences. These items stay on your device.

Data on our server

For each store, our server keeps a usage file named after the store's myshopify.com address. It contains:

• daily counts of views and clicks for each badge, and click counts for each icon and type of click action
• the day counting started, page views per day for the monthly view limit, and whether and when the store went over it
• for email notices: your store's contact email in Shopify, when it was last read, whether you turned the notices off and the month each kind of notice was last sent
• for the store check: badges that found no place on a product or cart page, with the page type, the number of reports and the first and last report, for 30 days
• the current plan and the status of the Shopify subscription: subscription ID, plan, billing interval, status, test flag, dates and trial days
• if you turned on sales after badges: whether it is on and since when, the ID of YeahBadges's web pixel in your store, and for each day the number of orders placed after a badge view, their revenue per currency and, for each badge, the number of those orders, how many of them followed a click on it, and their revenue
• for each counted order, for 35 days: a short code that our server derives from the hash the pixel sends, using a secret key, so an order counts only once. The code cannot be turned back into the order ID.
• where the installation came from, once per installation: the time the server first saw your store, and the Shopify App Store page and position and the campaign parameters (utm_*) of the first YeahBadges page Shopify opened for your store, if that page carried them. For an App Store search this includes the search term. Our server also writes this record with your store's myshopify.com address to its log, which is overwritten as it rotates.

Apart from your store's contact email for email notices, the file contains no names, email addresses, IP addresses, customer IDs, order IDs, product IDs or payment details. Daily counts and daily sales totals older than 800 days are deleted automatically. The whole file is deleted when you uninstall YeahBadges or when Shopify asks us to delete your store's data.

To suggest icons, the server reads up to 25 product types of your store and keeps them in memory for 24 hours. For the claim check, it reads the return window of your return rules (the number of days, whether you accept returns, and the days of rules for other markets) and keeps it in memory for one hour. Neither is written to disk.

If your store is password protected, you can enter its storefront password in the preview of the YeahBadges admin, so that the preview shows your real store pages without opening your store in a new tab. Our server enters the password on your store as a visitor would, keeps the visitor cookies of that visit in memory for up to six hours and uses them only to read your own store pages: for the preview, and for the editor's checks of accepted payment methods and published policies, which read your product page. If you choose "Remember for previews", the server also keeps the password in a second file for your store, encrypted in the same way as the usage file, and enters it again when the cookies have expired. If you do not choose it, the password stays in the server's memory for at most six hours and is never written to disk. The password is never shown again, never written to logs and never part of the page copies of the preview. It is replaced when you enter a new one and deleted when you choose "Forget saved store password" in the YeahBadges admin, when our server finds that your store no longer accepts it, when you uninstall YeahBadges or when Shopify asks us to delete your store's data. Encrypted backup copies are kept as described under "Where data is stored".

Signing in and access tokens

Your browser loads the YeahBadges admin from our server. The app does not log these requests, except the one record of where the installation came from (see "Data on our server"). If the admin meets an unexpected error, your browser sends the kind of error, where in the app's own code it happened and the kind of admin view that was open (such as the start page or a badge editor, without its ID) to our server, which writes them with your store's myshopify.com address to its log so we can fix the error. These reports contain no error messages, no badge content and nothing you typed, and the log is overwritten as it rotates. When you open YeahBadges in the Shopify admin, Shopify gives the app a short-lived session token that identifies your store and your staff account. Our server checks this token on every request for your data. For billing, icon suggestions, adding or removing the web pixel, reading your return window and reading your store's contact email for email notices, the server exchanges it with Shopify for a short-lived access token and uses it only for that request. Shopify's answer to this exchange also contains details of your staff account, such as its name and email address. YeahBadges does not use these details and does not store them. YeahBadges does not store session tokens or access tokens.

Data about shoppers

YeahBadges does not set cookies. Unless you turn on sales after badges, YeahBadges receives nothing from your storefront beyond the view and click counts described below.

To count views and clicks, the badge script sends the IDs of the badges shown on a page to your store's own address. For a click, it also sends the icon and the type of action, such as link, popup or discount code. Shopify forwards this request to our server through its app proxy and adds the store address, a timestamp and a signature. As part of forwarding, Shopify also passes on the shopper's IP address and, if the shopper is logged in, their customer ID. YeahBadges checks the signature and saves only the counts. It does not store the IP address or the customer ID.

When the badge script counts a view or a click, it also passes the IDs of those badges to Shopify's customer events (yeahbadges:badge_view and yeahbadges:badge_click), whether or not sales after badges is on. Shopify delivers customer events only to pixels that the shopper's privacy choices allow. Other pixels in your store that listen to all customer events, such as a custom pixel for an analytics service, can receive these badge IDs. They contain no personal data.

Rules for customer tags and countries are checked in the shopper's browser. YeahBadges's app embed and app block write the tags of a logged-in customer and the country currently selected in the storefront into the page, even when none of your badges uses these rules. This information is only part of the page that this shopper sees. The badge script compares it with your settings in the browser and does not send it to YeahBadges.

When an icon offers a discount code, the code is copied to the shopper's clipboard. If you turn this on, the script also adds the code to the cart through your store's own cart. None of this is sent to YeahBadges.

The badge script, icons, payment logos and store badges load from Shopify's servers.

Sales after badges (web pixel)

If you turn on sales after badges in Analytics, YeahBadges adds a Shopify web pixel to your store. Shopify runs it only when analytics is allowed for the shopper under your store's privacy settings, for example after the shopper accepts analytics in your cookie banner. The pixel is not used for marketing, preferences or the sale of data.

• The pixel receives the badge IDs that the badge script passes to Shopify's customer events and keeps them in the browser's session storage for this visit (key yeahbadges-badges), at most 50 badges each for views and clicks.
• When the shopper completes a checkout in the same visit, the pixel sends to our server: your store's myshopify.com address, the order total and its currency, the IDs of the badges seen and clicked, and a SHA-256 hash of the order ID. It never sends the order ID itself or the products in the order, and it reads and sends no names, email addresses, phone numbers or addresses.
• Our server checks the request, counts the order once for each badge that had views in the last 30 days and saves only the totals and the short order code described under "Data on our server". It does not store the hash or the IP address. It uses the IP address only in memory, to limit the number of requests per address and per store and address.
• When you turn sales after badges off, YeahBadges removes the pixel from your store. The totals stay in your analytics until you uninstall YeahBadges.

The numbers are estimates: they count only visits where analytics was allowed, and a shopper who saw a badge might have bought anyway.

Email notices

YeahBadges emails your store's contact email in Shopify (the address Shopify uses to reach the store owner) when a live badge stops showing in your store, for example because your theme could not read the badge settings, the badge script did not start or a badge found no place on a page, and when 80% of your monthly views are used. You get at most one email of each kind per month. An email about a failing badge goes only after at least three different visitors of your store reported the same failure within 24 hours; to tell them apart, our server keeps a code derived with a secret key from each visitor's IP address and browser name, only in its memory and for at most 24 hours, never the address itself. The emails contain your store's myshopify.com address, what happened and a link to YeahBadges, and nothing about shoppers.

Our server reads the address from Shopify when you open YeahBadges, at most once a day, and keeps it in your store's usage file. You can turn the notices off on the Plan page in YeahBadges; our server then deletes the address and stops reading it. The emails are sent through Zoho Mail, the email provider of our mailbox (Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, data center in the EU).

Billing

Paid plans are billed by Shopify. YeahBadges never receives card or bank details. Our server keeps the subscription status described above.

How we use data

We use the data only to provide YeahBadges: to show your badges, to count views and clicks for your analytics and plan, to send you email notices, to manage your subscription and to keep the app secure. We do not sell data, do not use it for advertising and do not build profiles of merchants or shoppers.

Legal bases

Where the GDPR applies, we process merchant data to provide the app you installed (Article 6(1)(b) GDPR). This includes your store's contact email and the email notices sent to it, which are part of the service; you can turn them off in the app at any time. We process technical data of storefront requests, such as the IP address that Shopify passes on, based on our legitimate interest in counting views correctly and securely (Article 6(1)(f) GDPR). We process the data the web pixel sends based on your and our legitimate interest in measuring the effect of your badges (Article 6(1)(f) GDPR), and only in visits where analytics is allowed under your store's privacy settings.

Where data is stored

Our server is a virtual server rented from Hetzner Online GmbH in a data center in Germany. An encrypted copy of the server data is backed up every night to a computer of the provider in Germany and kept for up to 12 months; a store's data leaves the backups when their period ends. Data in your Shopify store is processed by Shopify under Shopify's privacy policy.

Requests to access or delete data

Shopify forwards privacy requests from merchants and shoppers to the apps a store uses. YeahBadges handles them as follows:

• Customer data request (customers/data_request): YeahBadges stores no data that identifies individual shoppers, so there is nothing to provide. The app confirms the request.
• Customer data deletion (customers/redact): there is nothing to delete for the same reason. The app confirms the request.
• Store data deletion (shop/redact): YeahBadges deletes the store's files on our server.

YeahBadges also deletes the store's files as soon as Shopify reports that the app was uninstalled (app/uninstalled).

Security

All connections use HTTPS. Our server checks Shopify's signature on every storefront request through the app proxy and every webhook, and a valid session token on every admin request for your data. Requests of the web pixel carry no signature; the server accepts them only for stores that turned sales after badges on, checks their content strictly and limits their number. Each store's files are encrypted at rest with AES-256-GCM and a key kept apart from the data, and stored with file permissions that limit access to the app.

When you contact us

If you write to us, we use your email address and message to answer you. Emails to our support address pass through the email provider that hosts this mailbox. We keep this correspondence only as long as your request and our legal obligations require.

Your rights

Depending on the law that applies to you, you can ask for access to your data, correction, deletion, restriction of processing or a copy of your data, and you can object to processing based on legitimate interests. You can also complain to a data protection authority. To make a request, contact us at support@yeahforge.com. YeahBadges holds no data that identifies individual shoppers, so shoppers with questions about their data should contact the store.

Changes to this policy

We update this policy when YeahBadges's data handling changes. The date at the top shows the current version.

Data processing agreement

This agreement applies to every merchant who installs YeahBadges, as far as YeahBadges processes personal data of the merchant's shoppers on the merchant's behalf. It follows Article 28(3) of the General Data Protection Regulation (GDPR) and describes the processing as it is built today.

Parties

• Controller: the merchant who installed YeahBadges in their Shopify store ("Merchant").
• Processor: YeahForge, contact support@yeahforge.com ("Provider").

The agreement takes effect when the Merchant installs YeahBadges or accepts this agreement, whichever is later, and ends when the Merchant uninstalls YeahBadges and the deletion under section 9 is complete.

1. Subject matter and duration

The Provider processes personal data on behalf of the Merchant only to run YeahBadges for the Merchant's store: to show the Merchant's badges, to count badge views and clicks, to limit abusive requests and, if the Merchant turns it on, to estimate sales after badge views. Processing lasts as long as YeahBadges is installed, plus the deletion periods in section 9.

2. Nature, purpose, data and data subjects

Details are in Annex 1. In short: YeahBadges processes the IP address that Shopify forwards with storefront requests (in memory only, to limit requests), and, with the Sales after badges feature turned on, the order total, its currency and a keyed code derived from a hash of the order ID. It stores no names, email addresses, phone numbers, postal addresses, customer IDs, order IDs or payment details. Data subjects are the Merchant's shoppers. Data of the Merchant's staff that Shopify includes in token exchanges is not used or stored.

3. Instructions

The Provider processes the data only on the Merchant's documented instructions. The settings the Merchant makes in YeahBadges (for example turning Sales after badges on or off, uninstalling the app) and this agreement are the complete instructions. The Provider informs the Merchant without delay if it believes an instruction infringes data protection law. Processing required by law of the Union or a Member State is disclosed to the Merchant beforehand unless that law prohibits it.

4. Confidentiality

Only persons who need access to run YeahBadges have access to the data. They are bound to confidentiality by contract or by law.

5. Security

The Provider takes the technical and organisational measures of Annex 2 (Article 32 GDPR). It may adapt them as long as the level of protection does not fall.

6. Sub-processors

The Merchant gives general authorisation for the sub-processors in Annex 3. The Provider informs the Merchant at least 30 days before adding or replacing a sub-processor, by email to the store's contact address or by a notice in the app; the Merchant may object within that period, and if no solution is found, may end the agreement by uninstalling YeahBadges. The Provider passes on the obligations of this agreement to each sub-processor and remains liable for them.

7. Assistance with rights of data subjects

YeahBadges stores no data that identifies individual shoppers. Shopify forwards data requests and deletion requests of shoppers (customers/data_request, customers/redact) and of stores (shop/redact); the Provider answers them as described in the privacy policy. Beyond that, the Provider assists the Merchant with requests of data subjects on request, as far as the nature of the processing allows.

8. Assistance with security, breaches and impact assessments

The Provider notifies the Merchant without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Merchant's data, with the information available at that time (Article 33(2) GDPR). It assists the Merchant with Articles 32 to 36 GDPR as far as the information needed is available to it.

9. Deletion and return

• When the Merchant uninstalls YeahBadges, Shopify notifies the Provider (app/uninstalled), and the Provider deletes the store's files on the server at once (the usage file and, if stored, the storefront password for the preview). It does the same on a store deletion request (shop/redact).
• Encrypted backup copies of the server data are kept for up to 12 months (14 daily, 8 weekly, 12 monthly copies) and are deleted when their period ends. They are not restored except to recover from a failure; a restored file of an uninstalled store is deleted again.
• Data held only in memory (IP addresses for request limits, product types, return windows, a storefront password entered without "Remember for previews" and the visitor cookies of the preview) ends at the latest after 24 hours.
• Returning data: the Merchant sees all stored counts and totals on the Analytics page and can request a copy of the store's file at support@yeahforge.com before uninstalling.

10. Information and audits

The Provider makes available the information needed to show compliance with this agreement and allows for and contributes to audits by the Merchant or an auditor mandated by the Merchant. Audits take place with reasonable notice, during business hours and without disturbing operations; the Provider may first answer with written information and documents.

11. Liability and precedence

Liability follows Article 82 GDPR. Where this agreement and other terms between the parties differ on data protection, this agreement takes precedence.

Annex 1: Description of the processing

• Data subjects: Shoppers visiting the Merchant's store
• Storefront requests: Shopify's app proxy forwards each view or click report with the shopper's IP address (and the customer ID of a logged-in shopper). YeahBadges keeps the IP address, IPv6 shortened to its /56 prefix, only in the server's memory to limit requests per shopper (at most 24 hours), and for reports of a failing badge a code derived from it and the browser name with a secret key, also only in memory for at most 24 hours, and stores neither the address nor the customer ID. Stored: daily counts per badge, icon and click action.
• Sales after badges (optional, off by default): Runs only in visits where analytics is allowed under the store's privacy settings. The web pixel sends the store address, order total, currency, the IDs of badges seen and clicked and a SHA-256 hash of the order ID. Stored: daily totals per badge and currency, and for 35 days a code derived from the hash with a secret key, so that an order counts only once. The hash and the IP address are not stored.
• Store check: Badges that found no place on a page, with page type and report times, for 30 days. No personal data.
• Storefront password (optional): Entered by the Merchant in the preview of a password-protected store. Stored encrypted in a second file only with "Remember for previews", otherwise held in memory for at most six hours. Used only to load the Merchant's own store pages: for the preview and for the editor's checks of accepted payment methods and published policies. Deleted at the Merchant's request in the app, when the store no longer accepts it, on uninstall and on shop/redact. It is a credential of the Merchant, not personal data of a data subject.
• Purpose: Showing badges, counting views and clicks for analytics and plan limits, security of the counts, optional sales estimate
• Location: Server in Germany (Annex 3); backups on the Provider's computer in Germany
• Retention: Daily counts and totals 800 days, order codes 35 days, store check reports 30 days, backups up to 12 months, memory at most 24 hours, storefront password until the Merchant forgets it, the store refuses it or uninstall; everything of a store is deleted on uninstall (section 9)

Annex 2: Technical and organisational measures

• Encryption in transit: all connections use HTTPS (TLS). Encryption at rest: each store's files (usage counts and, if stored, the storefront password for the preview) are encrypted with AES-256-GCM, bound to the store and the file's purpose, with a key kept apart from the data; backups are encrypted with restic and a separate key.
• Access control: the server accepts storefront requests only with a valid Shopify app proxy signature and admin requests only with a valid Shopify session token; webhooks need a valid Shopify signature. The server administration is reachable only with an SSH key. The application runs in a container without Linux capabilities, with a read-only file system except its data volume, and binds only to the local interface behind its own reverse proxy.
• Data minimisation: no cookies, and no names, email addresses, IP addresses, customer IDs, order IDs or payment details of shoppers are stored; logs contain method, path without query, status and duration only, and tokens and passwords are redacted.
• Limits against abuse: request limits per shopper, store and minute and per shopper and day.
• Availability and resilience: automatic restarts and health monitoring with alerts, nightly security updates, encrypted nightly backups with retention, a weekly integrity check and restore tests.
• Deletion: automatic deletion on uninstall and on Shopify's store deletion request; automatic removal of data older than its retention period.

Annex 3: Sub-processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: Rented virtual server that runs YeahBadges and stores the store files, Germany

Shopify processes the Merchant's store data under its own terms with the Merchant and is not a sub-processor of the Provider. Push alerts about server availability (ntfy.sh) contain no personal data.

Legal notices

Provider of YeahBadges: YeahForge

Contact: support@yeahforge.com

Trademarks

App Store is a service mark of Apple Inc.

Google Play and the Google Play logo are trademarks of Google LLC.

Payment brands and logos shown in YeahBadges are trademarks of their owners. Showing a mark does not mean that its owner endorses YeahBadges.

Official store badges

The "Download on the App Store" and "Get it on Google Play" badges come unchanged from the official badge packages of Apple and Google. They are used under the owners' guidelines:

• Apple: App Store Marketing Guidelines
• Google: Google Play badge guidelines

In the storefront, YeahBadges shows these badges only in their original form, at the required minimum size and with the required clear space, and links them only to the App Store or Google Play. Merchants who show these badges are responsible for using them in line with these guidelines.

Payment logos

Payment logos come unchanged from Shopify's payment icon library (activemerchant/payment_icons, MIT License, Copyright 2015 Shopify Inc). In the storefront they load from Shopify. Merchants choose which logos to show, so a logo does not confirm that a store accepts that payment method.

Icons

All other icons and seals in YeahBadges are original drawings made for the app. Merchants are responsible for the rights to images they upload.