Cury Apps / Cury SEO
Cury SEO

Privacy Policy

Effective date: May 25, 2026 · Last updated: May 25, 2026

1. Plain-language summary

Cury SEO is a Shopify embedded app developed by Cury Apps. When you install it on your Shopify store, the app reads your product catalog (titles, descriptions, SEO fields, images and alt text) to detect missing or sub-optimal fields, and can update image alt text on your behalf when you trigger that action.

We do not collect data about your customers. We do not use third-party analytics or tracking. We do not sell or share your data. When you uninstall the app, all data we hold about your store is deleted.

Heads up. This Privacy Policy is a good-faith plain-English document written by the app's developer. It is not a substitute for advice from a lawyer in your jurisdiction. If anything here is unclear, contact us before installing.

2. Who this applies to

This Privacy Policy applies to:

  • Shopify merchants who install the Cury SEO app on a store they own or operate.
  • Visitors to curyapps.com and its sub-pages.

It does not apply to data your store collects from your end-customers — that is governed by your own privacy policy.

3. Data we access

When you install Cury SEO, the app receives and may temporarily cache the following data from your Shopify store, using the Shopify Admin GraphQL API and the access scopes read_products and write_products:

  • Shop identifier (e.g. your-store.myshopify.com) and the OAuth session token Shopify issues to the app.
  • Product data: product titles, handles, descriptions, meta titles, meta descriptions, variant names, and the media (images) attached to each product, including their alt text and CDN URLs.
  • Job metadata the app creates as it works: background analysis jobs and bulk-fix jobs, with progress and result counters.

The app writes back to your Shopify store only when you explicitly trigger a bulk fix or a single-product alt-text fix. In those cases the app updates the alt text on product images via the Shopify Admin API. No other field is written.

4. Data we do NOT collect

To be explicit, the app does not access or store:

  • Customer personal data of any kind (names, emails, addresses, orders).
  • Payment or billing information.
  • Browsing behavior, click streams, or session recordings.
  • Any data from Shopify resources outside the scopes granted at install time.

The app responds to Shopify's mandatory customers/data_request and customers/redact compliance webhooks with an empty payload because no customer data exists on our side.

5. How we use the data

We use the data described in §3 only to deliver the app's features:

  • Analyze each product against five on-page SEO checks (meta title, meta description, image alt text, description length, URL handle) and produce a per-product report.
  • Generate alt text suggestions derived from the product title and variant name, and apply them when you trigger the bulk-fix action.
  • Cache the latest analysis so the dashboard loads quickly and so re-analyses can run in the background.
  • Export your audit as a CSV when you request it.

We do not use your data for marketing, profiling, training machine-learning models, advertising, or any purpose unrelated to providing the app to you.

6. Where data is stored

Data is stored in a managed PostgreSQL database hosted on Railway. The application itself runs on Railway as well. Railway provides encryption at rest for managed databases, and all traffic between your browser, the app, and the Shopify Admin API uses TLS (HTTPS).

The data Cury Apps controls for Cury SEO is limited to:

  • A Session row per Shopify store, used to authenticate API calls.
  • A SeoCache row per store, holding the latest analysis snapshot (audit items and derived summary).
  • SeoJob rows tracking background job status (pending / running / done / failed) with progress counters.

7. Third parties

Cury SEO relies on the following service providers strictly to operate:

  • Shopify — for app authentication (OAuth), the Admin GraphQL API, App Bridge, and the embedded admin surface. Shopify's privacy practices govern data flowing through their APIs (shopify.com/legal/privacy).
  • Railway — hosting and managed PostgreSQL. See Railway's privacy practices at railway.com/legal/privacy.
  • Cloudflare — DNS, registrar and email routing for the curyapps.com domain. See cloudflare.com/privacypolicy.

We do not share your data with advertising networks, data brokers, or analytics providers. We do not run third-party analytics, heatmaps or tracking pixels inside the embedded app.

8. AI and automated processing

This release of Cury SEO does not use any artificial intelligence, large language model, computer vision, or third-party generative service. Alt text suggestions are produced by a small deterministic function that concatenates the product title and the variant name. No content is sent to any AI provider.

Future versions may introduce optional features that use AI (for example, image-based alt text generation). When that happens, this Privacy Policy will be updated, the change will be highlighted, and any such feature will be clearly opt-in.

9. Cookies and tracking

The app runs embedded inside the Shopify Admin via an iframe. The only cookies used are those set by Shopify and App Bridge to keep your admin session valid. Cury Apps does not set its own analytics, advertising or tracking cookies inside the app.

The marketing pages on curyapps.com are static and do not set tracking cookies either. Standard server access logs may be retained by Cloudflare and Railway for security and rate-limiting purposes, in line with their own policies.

10. Data retention & deletion

We keep your data only for as long as the app is installed on your store. Concretely:

  • The analysis cache is refreshed when you re-analyze, and is fully replaced on each fresh run.
  • Background job records persist for a short period for visibility into progress and failures, and are not used for any other purpose.
  • When the app is uninstalled (or when Shopify sends a shop/redact webhook 48 hours after uninstall), all of your store's data is deleted from our database.

You can also request manual deletion at any time by contacting us at the address in §14.

11. GDPR / privacy rights

Depending on where you operate, you may have rights under the GDPR, the UK GDPR, the CCPA / CPRA, or similar regulations. These typically include:

  • The right to know what data is held about you.
  • The right to request a copy of that data.
  • The right to request correction or deletion.
  • The right to object to certain types of processing.

Because Cury SEO does not process end-customer personal data, most GDPR-style requests will result in an empty response on our side. For merchant account data (the shop identifier and session token), uninstalling the app triggers deletion automatically. If you'd like a confirmation of deletion or a copy of the data we held, email support@curyapps.com.

12. Security

We take reasonable steps to protect your data:

  • All traffic is served over HTTPS / TLS.
  • Database access is restricted to the application and isolated within Railway's private network.
  • Shopify session tokens are stored using the official @shopify/shopify-app-session-storage-prisma adapter.
  • No production secrets are stored in source control.

No system is perfectly secure. If you become aware of a vulnerability, please email support@curyapps.com with details and we will respond as quickly as possible.

13. Changes to this policy

We may update this Privacy Policy from time to time, for example when we add a new feature, change a sub-processor, or clarify language based on user questions. The Effective date at the top of this page reflects the current version. Material changes — especially anything that would expand how your data is used — will be communicated through the app's interface or via email to the shop's primary contact before they take effect.

14. Contact

If you have questions about this Privacy Policy, want to exercise a privacy right, or have concerns about how the app handles your data, contact us at: