Data & privacy

What Codebeans Wishlyst stores, where, for how long, and how it is deleted.

This page summarises how the app handles your store’s data and your shoppers’ data. For the complete statement, request the Codebeans Wishlyst Data Handling Statement from [e-mail].

​

What the app stores

Data	Details
Wishlists	Name, public/private setting, the customer ID (logged-in shoppers) or an anonymous session ID (guests)
Wishlist items	Product and variant IDs, and when they were added
Shares	Recipient email for email shares. Share tokens are stored only as a hash.
Email log	Recipient, template, status and errors. Email bodies are not stored.
Email link clicks	Which tracked product link was clicked, and the order it led to
Unsubscribes and bounces	Email addresses that unsubscribed or bounced, so they are not emailed again
Settings	Your widget settings, templates and SMTP settings

The app does not store customer names or email addresses with wishlists. It looks them up from Shopify when you view them. Product titles, prices and images are also fetched live from Shopify.

​

In your shoppers’ browsers

Item	Purpose
sessionId (localStorage)	Identifies a guest’s wishlist
Small caches (localStorage)	Speed up the drawer and remember recently viewed products
cbwishlist_email_ref (cookie, 48 hours)	Credits an order to a reminder email click

​

In your Shopify store

• Settings and templates are saved as app-owned shop metafields.
• Orders placed from a wishlist get the tag cbwishlist-order.
• Products added from a wishlist carry hidden cart line properties (starting with _), which customers do not see at checkout.
• A web pixel reports completed checkouts that followed a reminder-email click, so the app can credit the sale.

​

Retention

Data	Kept until
Signed-in customers’ wishlists	The customer or you delete them, or the customer’s data is erased
Guest wishlists	90 days after they are created
Everything for your store	About 48 hours after you uninstall, when Shopify sends the shop erasure request

​

Customer data requests

The app handles Shopify’s privacy webhooks:

• Customer erasure (customers/redact): deletes the customer’s wishlists and shares, removes them from email logs and click tracking, and stops their campaigns.
• Shop erasure (shop/redact): deletes all of your store’s data from the app.
• Customer data request (customers/data_request): contact support for a copy of a customer’s wishlist data.

​

Your responsibilities

• The app does not check Shopify’s email marketing consent before sending reminder and alert emails. Every promotional email includes an unsubscribe link. Make sure your privacy policy covers wishlist reminder emails.
• Keep your API key and MCP tokens secret.