Privacy Policy — ParityTest — Price A/B Testing
Last updated: 2026-08-13
What this app does
ParityTest — Price A/B Testing (“ParityTest”, “we”, “us”) is a Shopify app that runs price A/B tests on a merchant's storefront. It assigns each storefront visitor to a price test group, serves the corresponding price via a Shopify Discount Function, and records the outcome so the merchant can see which price group performs better.
Information we collect
From merchants
When a merchant installs the app, we receive standard Shopify OAuth access — an access token scoped to write_products, write_discounts, read_discounts, and read_orders— and basic shop information (shop domain, and whatever the Shopify Admin API returns for shop info). We do not collect the merchant's personal contact details beyond what Shopify itself provides through the standard app-installation flow.
From the merchant's storefront visitors
For each storefront visitor who is exposed to an active price test, we record:
| Field | What it is | Identifies a person? |
|---|---|---|
shop | The merchant's shop domain | No |
product_id / variant_id | Which product/variant was being tested | No |
group_label | Which price group (e.g. “A” or “B”) the visitor saw | No |
session_id | A random identifier generated in the visitor's browser tab, used only to avoid counting the same page-view twice | No — not tied to any account, email, or persistent identity; cleared when the browser tab is closed (see “Cookies and browser storage” below) |
order_id / line_item_id | If the visitor completes a purchase, the resulting order and line item ID | Indirectly — an order ID can be used by the merchant to look up who placed the order, so we treat it as data connected to that customer for deletion purposes (see below) |
revenue_cents | The dollar (or local currency) amount of the resulting sale, if any | No |
We do not collect names, email addresses, physical addresses, phone numbers, payment details, or any other directly identifying information about storefront visitors or customers. The only way any stored record connects back to an individual is through the order_id, which the merchant's own Shopify admin can already resolve to a customer — we do not add any new way to identify someone that the merchant doesn't already have.
Cookies and browser storage
Per Shopify's guidance to disclose information gathered directly from a visitor's device, here is exactly what our storefront script reads and writes in the visitor's browser:
| Mechanism | Name | Purpose | Lifespan |
|---|---|---|---|
| Reads an existing first-party cookie set by Shopify itself (we do not set this cookie) | _shopify_y | Used only to derive a consistent, anonymous “bucket” number (0–9999) so the same visitor sees the same price group on repeat visits, instead of being re-randomized every page load | Controlled by Shopify, not by us |
localStorage (falls back to this only if _shopify_yisn't available) | ab_bucket | Stores a randomly generated bucket number so repeat visits from the same browser stay in the same test group | Persists until the visitor clears site data |
sessionStorage | ab_session_id, ab_exposed_<product_id>, ab_attr_set | Used only to avoid double-counting the same product view or duplicate cart updates within a single browser tab session | Cleared automatically when the browser tab is closed |
None of these values are names, email addresses, or any other directly identifying information, and the bucket/session values themselves are never sent anywhere outside the visitor's own browser except as the resulting group (e.g. “A” or “B”) and session_id fields described in the table above. We do not use any third-party advertising or tracking cookies, and we do not use this data to build cross-site profiles or for retargeting.
How we use this information
Solely to calculate and display price-test results to the merchant: how each price group performed, and (as our primary metric) profit generated per visitor in each group. We do not use this data for advertising, do not sell it, and do not share it with any third party except the infrastructure providers described below, who process it strictly on our behalf.
Where data is stored, and international transfers
- Shop-level authentication tokensare stored in Cloudflare Workers KV, associated with the shop domain, encrypted in transit and at rest by Cloudflare's platform.
- Test event and result data (the fields listed above) is stored in a Postgres database hosted on Supabase.
- Both providers act as data processors for us; neither uses this data for their own purposes.
- Cloudflare and Supabase operate global/regional infrastructure, which means data may be processed or stored outside the country where a storefront visitor is located, including transfers out of the European Economic Area (EEA), UK, or Switzerland where applicable. Test event and result data is stored in Supabase's Singapore region (AWS ap-southeast-1). Shop-level authentication tokens in Cloudflare Workers KV are replicated across Cloudflare's global network. Where personal data relating to visitors located in the European Economic Area, the United Kingdom, or Switzerland is transferred outside those regions, we rely on the safeguards in our processors' data processing agreements — including the Standard Contractual Clauses incorporated into Cloudflare's and Supabase's data processing addenda.
- We do not have a dedicated Data Protection Officer. Based on the limited, non-sensitive data this app processes (no special-category data, no large-scale systematic monitoring), we do not believe a DPO is required under GDPR, but this determination should be confirmed by your legal reviewer. For any privacy-related request, contact us using the details below.
Data retention
Test event data is retained for as long as the merchant's price tests are active or under analysis, and until the merchant uninstalls the app, at which point all of that shop's data is deleted (see “Uninstalling the app” below).
GDPR and other data subject rights
This app implements Shopify's three mandatory compliance webhooks:
customers/data_request— if a customer asks a merchant for the data held about them, we check for any records tied to their orders. Because we do not store names, emails, or other identifying fields, there is typically nothing to export beyond what's described in this policy.customers/redact— if a customer asks a merchant to delete their data, we delete every test-event record tied to the order(s) named in that request.shop/redact— 48 hours after a merchant uninstalls the app, we delete all of that shop's data: its stored access token and every test-event record associated with it.
If you are a customer of a store using this app and want to exercise these rights directly, please contact the merchant — Shopify requires these requests to go through the merchant, who will forward them to us via the mechanisms above.
Uninstalling the app
Uninstalling removes the app's access to the store. Per the shop/redactprocess above, all stored data for that shop is deleted within 48 hours of uninstall, in line with Shopify's required data-retention behavior for uninstalled apps.
Changes to this policy
We may update this policy as the app's features change. Material changes will be reflected here with an updated “Last updated” date.