Delivery Guard

Privacy policy

Last updated 20 October 2026.

Delivery Guard ("the app") is a Shopify app made by Marvel Labs. It lets merchants ask customers for a delivery or pickup date and time slot, and makes sure orders arrive with a date the shop can fulfil. This policy explains what the app collects, why, and what happens to it.

What the app collects

• Store details: the shop's myshopify domain and the access token Shopify issues when the app is installed, so the app can act on the merchant's orders.
• Delivery settings the merchant enters: locations, opening days, time slots and capacity, cutoffs, closed dates, delivery postcodes, product rules and notification settings (including an alert email address, if they enter one).
• Bookings: for each order, its Shopify order ID and number, the chosen date, time slot, delivery or pickup, and location, plus when the app processed it. No customer names, email addresses, phone numbers or payment details are read or stored, and no addresses are stored: at checkout the app only compares the delivery postcode with the merchant's delivery area.

What the app reads from Shopify but doesn't keep

• Order details needed to do its job: line items and their properties, products and their collections, the order's delivery choice, and fulfillment orders (to hold and release them). The prep list shows items and order notes to the merchant inside Shopify admin.
• The live theme's configuration files, only to show the merchant whether the date picker block and app embed are set up on their theme. No theme content is stored or changed.

How it's used

Only to provide the app's features: checking dates at checkout, counting bookings against slot capacity, tagging and holding orders, letting customers choose a missing date, alerting the merchant to overbooked slots, and showing prep lists. The app doesn't sell or share data, show ads, or track shoppers. The storefront date picker sets no cookies; the choice is saved on the cart and order.

Who processes it

The app runs on Railway's servers (data encrypted in transit and at rest) and sends merchant alert emails through Resend. If a merchant uses "Describe your delivery days", the text they type (and today's date) is sent to Anthropic's Claude API to fill in their settings; it never includes orders or customer data. Each of these processes data only on our behalf. Shopify's own handling of store and customer data is covered by Shopify's privacy policy.

How long it's kept

Settings and bookings are kept while the app is installed. When a merchant uninstalls the app, Shopify asks us to erase the shop's data 48 hours later, and we delete all of it: settings, bookings and tokens. When a customer asks Shopify to erase their data, we delete the bookings for their orders.

Your rights

Customers should contact the shop they ordered from, which can request access to or deletion of their data through Shopify. Merchants can contact us at info@marvel-labs.com with any privacy question or request. Our terms of service include the data processing terms that apply between us and merchants.