Sizecurve — Privacy

Last updated 2 October 2026

What Sizecurve reads

When you install Sizecurve it requests three read-only permissions: read_orders, read_products and read_inventory. It uses them to read, from the last 60 days:

• your products and their size variants,
• how many units of each variant were ordered, and on what date,
• how many units of each variant were refunded,
• how many units of each variant you currently hold.

That is the whole list. Sizecurve does not read customer names, email addresses, shipping addresses, phone numbers or payment details, and it never requests the permissions that would let it. Line items are reduced to a variant and a quantity before anything else happens to them.

What Shopify's install screen lists

The install screen, and the Data access section of the App Store listing, are written by Shopify and describe what the permissions allow. Because Sizecurve holds read_orders, that list says it can view customer device and activity data — the IP address, browser and location recorded on an order — and the store owner's name and contact details. Sizecurve reads none of the order fields: its order query asks for each line's variant and quantity, and each refund in the same shape, and nothing about who placed an order or from where. Of the owner's details it reads two, your store's name and contact email, and only to address the emails described below.

What Sizecurve stores

One record per shop, containing your shop's domain, the access token Shopify issued at install, the date you installed, and whether you want the weekly email. Alongside it, two working files:

• The current analysis — size curves, stock positions and reorder quantities, computed from the reads above. It is a cache, rebuilt at most hourly while you use the app and once a week by the scheduled job, so that opening the app does not mean re-reading your whole catalogue.
• What changed — a short history of transitions, such as a size run breaking or returns crossing 30%, kept so the app can tell you what is new rather than only what is true. At most fifty entries, each one a style name, a date and a sentence.

No order, no line item and no customer is stored. Order data is reduced to a variant and a quantity in memory and discarded; what persists is the arithmetic, not the orders.

The weekly email

On the weeks something changes, Sizecurve emails your store's contact address — the one Shopify already holds for you — with what changed. Nothing is sent on the weeks nothing changes. Once, in the last week of a free trial, it also sends one email saying what it has found and the day the trial ends, and nothing if it has found nothing. Every message carries a one-click link that stops them, and your mail client's own unsubscribe button works too. The message is delivered by Resend, which receives the address and the text of that email and nothing else. Your store's contact address is read from Shopify each week and is not stored with the message.

Counting visits to this site

Sizecurve counts page views on its own pages so that it can tell whether nobody visits or everybody leaves. The count is kept on our own server, per page, per day, for thirty days, along with the hostname a visitor arrived from — youtube.com, google.com, or "direct" — and a separate tally of requests that identify themselves as crawlers.

Most of what asks a small website for a page is not a person. So these pages also carry a short script, /px.js, which requests a one-pixel image from this site twice: once when the page has actually been drawn in a visible window, and once more the first time anything happens on it that a person does — a scroll, a key, a tap. It fires at most once each, and if you do nothing, the second one never fires at all. All that arrives here is which of the two it was and which of the nine pages it came from. Nothing is sent about you, about what is on the page, or about what you did beyond the fact that you did something.

It also asks for a third image, at /px.gif, which the server answers and does not count. That address matches a rule on the EasyPrivacy filter list, so if you run uBlock Origin, AdGuard, Brave shields or a Safari content blocker, your browser will refuse to fetch it — and the script reports which of those two happened, as a single bit, once. It exists because the counter above used to live at that address, which means a large share of visitors were never counted at all, and a number that silently omits the people most careful about being measured is worse than no number. Nothing about you is sent with it: it is one of two counters going up by one, and it is not used to decide anything you see.

That is all of it for those counters. There is no cookie, no identifier, no fingerprinting, and no record of your IP address or your browser. Every one of these numbers is a counter that goes up by one; not one of them is a row about a visit. The referring address is reduced to its hostname before anything is written down, so a search term or a page title in a referrer is discarded and never stored. The counter cannot tell one visitor from another, cannot follow you between pages, and cannot follow you off this site. It answers how many, to what, from where, and how many of those were awake, and nothing else about anyone.

Each page also loads the site's own visit counter from pulse.bananafest-destiny.com, which records the page, the referring page and the screen width, with no cookie, no identifier and nothing about you.

One script we did not put there

Cloudflare hosts this site, and inserts its own analytics script — static.cloudflareinsights.com/beacon.min.js — into every page it serves to a browser. We did not add it, we have no account that reads it, and we use nothing it collects. This site's Content-Security-Policy refuses it: your browser blocks the script before it is fetched, so it never runs and Cloudflare's analytics is sent nothing about your visit. You can see the refusal for yourself in your browser's console on any page here. We have asked for the injection to be turned off at the platform level. Until it is, the tag is in the page and that block is what stops it, which is why this paragraph exists rather than a flat claim that there is no third party.

The free check at /check

The check at /check needs no account and no install. You give it a storefront address, and an email address only if you want the result sent to you as well; it reads that storefront's public /products.json, the same file any shopper's browser can read, after reading and obeying that storefront's robots.txt.

If you give an email address, it is used to send you that one result, and is not written down. The result is cached for one hour, so that a second request for the same store returns the first answer instead of fetching somebody’s catalogue twice — that cache holds the storefront’s figures and nothing about you. To enforce the per-browser and per-address limits, a count is kept for the rest of the day against a one-way hash of your IP address and, if you gave one, of your email address: enough to tell one from another, not enough to name either. Neither is used for anything else and neither is shared.

A correction, 21 September 2026. Until today this paragraph said your address was stored for one hour and your IP for the rest of the day. That described how long they were used. The storage they were written to has no expiry, and nothing in the app ever deleted them, so in fact they were kept indefinitely — and two of them sat inside the names of records rather than in their contents. That is now fixed in both directions: the app no longer writes them, and everything it had already written has been deleted. We found this by auditing ourselves against this page rather than the other way round, and it seemed worse to correct it quietly.

You are not added to any list. Until Sizecurve was approved for the Shopify App Store on 29 September 2026, the check offered a box to be emailed once, on the day it became installable. That box is gone, and the list it filled holds no addresses. If you ever used the one-click removal link that came with it, the do-not-add record it created is kept only so that nothing puts you back on; it has no other use and is never given to anybody.

What Sizecurve never does

It does not write to your store. It does not sell or share your data. Apart from Cloudflare, which runs the app, Resend, which delivers the weekly email, and the site's own visit counter, which records the page, the referring page and the screen width, with no cookie, no identifier and nothing about you, there is no other recipient of any kind — no advertising, no third-party tracking.

Deleting your data

Uninstalling the app deletes everything above — the access token, the cached analysis, the change history and your email preference — automatically and immediately — Sizecurve acts on Shopify's app/uninstalled webhook. Because the app holds no customer data, a customer data request or erasure request has nothing to return or remove; shop erasure requests delete the shop record. What remains is a log of installs and uninstalls that names no store: when each happened, how long the app was installed, how many sized styles it found, and whether a plan was ever active.

Contact

Sizecurve is made by Bananafest Destiny. For any privacy question, or to ask what is held about your shop, email support@bananafest-destiny.com and we will answer.

The processing obligations we hold ourselves to are set out in the terms of service.

Built in public by an autonomous agent — the full log is at bananafest-destiny.com/zoo/cider2