Flatdesk: privacy

Last updated 17 October 2026

What Flatdesk reads

When you install Flatdesk it asks Shopify for four permissions: read_customers, read_orders, write_orders and write_app_proxy. With the first two it reads, for the email address on a ticket, that customer's first name and their last five orders: the order number, date, total, items, payment and fulfilment status, shipping address, and tracking numbers and links. It reads these each time a ticket is opened and does not store them. With read_orders alone, Shopify returns only the last 60 days of orders.

It uses write_orders only when a staff member cancels an order, refunds it, or changes its shipping address from a ticket, and only after they confirm the step that shows what Shopify will do. A note on the ticket records who did it.

It uses write_app_proxy so that Shopify passes requests for /apps/flatdesk/ on your store to Flatdesk: the chat, the contact form and the help center. With each one Shopify tells Flatdesk which store it is for and, when the shopper is logged in, their Shopify customer ID. Flatdesk checks Shopify's signature on every such request before it reads anything else in it.

It also reads your store's name, to sign your replies.

What Flatdesk stores

The access token Shopify issues when you install, with the refresh token and expiry Shopify sends with it.
Your store's inbound address and your store's name.
Every email forwarded to your inbound address: who sent it, who it was to and copied to, its subject, its text, a cleaned copy of its HTML, and the message identifiers that let replies thread.
Attachments: each file sent with a customer's email or with your team's reply, up to 10 MB a file and 25 MB a message, with its file name, type and size. Larger files are not stored; only their name and size are.
Confirmation emails your mail host sends to your inbound address when you set up forwarding (the last 20), so the code can be shown on the Setup screen.
Your rules, and the Reports figures, which are counted from the tickets above and not stored apart from them.
While an import from your previous help desk runs: its address, the email of the user you name, and the API key you give. The key is deleted when the import finishes, fails or is cancelled. What it imports is stored like any other ticket.
Chat messages a shopper writes in the chat on your store, and contact forms they send: their email address, the name they give if any, the order number they give if any, and what they wrote. Each becomes a ticket like an email. When the shopper is logged in, their Shopify customer ID is kept with the ticket.
For each chat, a SHA-256 hash of the chat's token, never the token itself, and when it was last used. The token stays in the shopper's own browser storage, so they can return to the chat. Replies the shopper has not seen in the chat within two minutes are emailed to the address they gave; until then Flatdesk keeps a note of which replies are waiting.
Spam limits: for each chat, contact form address and your store, the times of recent messages. These are deleted after an hour.
Your help center articles: their titles, addresses and text, as you write them, and whether each is published. Published articles are public on your store.
Every reply and internal note your team writes, with the name of the staff member who wrote it, and whether each reply was sent.
Each ticket's status, assignee and tags, your saved replies, and the names of the staff who have opened the app.

Customer emails are personal data: they hold the customer's email address and name, and whatever they wrote. They are stored for one reason, so your team can answer them.

How long it is kept: until you uninstall Flatdesk, and then 48 hours. Uninstalling deletes the access token and your inbound address at once, so no more mail is taken in. Shopify sends its request to erase your shop's data 48 hours after an uninstall, and Flatdesk then deletes everything else it holds for your shop: every ticket (chat and contact form tickets included), message, note, attachment file, chat token hash, spam limit record, help center article, saved reply, rule and setting.

Deleting a customer's data

When Shopify sends a request to erase one of your customers' data, Flatdesk deletes every ticket whose customer has that email address, with all its messages, notes and attachment files, and every message from or to that address on any other ticket. Chats and contact forms are tickets with the address the shopper gave, so they go too, with the chat's token hash, any reply waiting to be emailed, and the spam limit records for that chat and address. When Shopify sends a request for a customer's data, the tickets that hold it are the ones your team can see in the inbox by searching for the customer's email.

Who else is involved

Cloudflare hosts Flatdesk, receives the email forwarded to your inbound address, and stores what is listed above. Attachment files are stored in Cloudflare R2. A mail delivery provider sends your team's replies, and so handles each reply's text, its attached files and the customer's address. During an import, Flatdesk reads your tickets from your previous help desk with the key you gave it. Shopify is the source of the order data and bills for the app. Flatdesk does not sell or share your data, and uses no analytics, advertising or tracking service.

The chat and the contact form set no cookies of their own and load nothing from outside your store; the chat keeps its token and the messages it has shown in the shopper's browser storage, which the shopper can clear. Images in customer emails are not loaded until a staff member presses "Show images" on that message, because loading a remote image tells its sender the email was opened.

Contact

For any privacy question, or to ask what is held about your shop, use the support contact on the app's Shopify App Store listing.