Petty Cash Labs
Privacy Policy
Effective August 17, 2026 · applies to the PocketCart app and pocketcart.shop
PocketCart moves a shopper's cart from a desktop browser to their phone. Doing that well requires storing remarkably little, and this policy is mostly a list of things we don't collect. It is written to be read.
What we store about shoppers
A handoff session, created when the PocketCart widget appears in a cart:
- Product variant IDs and quantities
- Line-item options and cart notes/attributes the shopper or the store added (e.g. "gift wrap: yes")
- Applied discount codes and the storefront country (so pricing stays correct)
- A random session code (e.g.
x7K2abc) — it identifies the cart, not the person
Handoff sessions self-delete after 24 hours.
We never store shopper names, email addresses, phone numbers, physical addresses, IP addresses, or any payment details. Payment happens entirely inside the store's own Shopify checkout; PocketCart is not part of the payment flow and cannot see payment data.
What we store about orders
When an order is placed through a PocketCart handoff, we record the Shopify order ID, order number, order total, currency, and the session code that produced it — so merchants see exactly which orders PocketCart delivered. These attribution records contain no shopper identity and are kept for up to 90 days.
What we store about merchants
The store's domain, the API tokens Shopify issues so the app can operate, and the merchant's app settings. Support email lives wherever the merchant emails us (hello@pocketcart.shop).
What we don't do
- No selling or sharing of data with third parties — full stop
- No advertising, no tracking pixels, no cross-store shopper profiles
- No marketing to shoppers — we have no way to contact them, by design
Support chat
The chat bubble on this website and inside the PocketCart admin app is provided by Crisp. If you open it, the messages you send are processed by Crisp and it sets its own cookies (see Crisp's privacy policy). The chat exists only where merchants are — it is never injected into your storefront and your shoppers never see it.
Where data lives
On Amazon Web Services in the United States, encrypted in transit (TLS) and at rest. Access is limited to Petty Cash Labs operators.
Deletion
- Shopper data requests: we honor Shopify's GDPR webhooks automatically. Since we hold no shopper personal data, redaction requests complete with nothing to redact, and data-access requests return nothing.
- Uninstalling PocketCart immediately deactivates the store and deletes its API tokens; remaining session and attribution records expire on their normal schedule (24 hours / 90 days).
- Shop data requests: we erase the store's record — settings, tokens, and usage history. If the store used its free trial, we keep one line: the store domain and the date the trial was used, so a reinstall can't start a second free trial. It holds no personal data and is used for nothing else.
- Merchants can request full immediate deletion anytime at hello@pocketcart.shop.
Changes
If this policy changes materially, the effective date above changes and merchants are notified in the app. The promise that shopper personal data stays out of our systems is architectural, not aspirational — the widget only ever transmits variant IDs and quantities.
Contact
Petty Cash Labs · hello@pocketcart.shop · pocketcart.shop