Centaur AppsBlogConnect Privacy Policy
Last updated: November 12, 2026
BlogConnect: Reply & Manage Comments ("the app") is a Shopify app made by Wyatt Chamberlin, who publishes apps as Centaur Apps ("we", "us"). It adds threaded comments and replies to a Shopify store's blog. This policy explains what information the app handles, why, and what happens to it.
It covers two groups of people: merchants who install BlogConnect in their Shopify store, and readers who comment on a blog that uses it.
Information we handle
From merchants and their Shopify store
When a merchant installs BlogConnect, Shopify gives the app access to the store under the permissions the merchant approves. BlogConnect uses:
- Store details: the store's Shopify domain and the app's access token for the store.
- Blog information: blog and article IDs, titles and handles, and which of them have comments turned on.
- The merchant's settings: comment and moderation settings, notification preferences, the email address for new-comment alerts, and any comment-box text the merchant customizes. Most settings are saved in the merchant's own Shopify store; we keep which blogs and articles have comments turned on, and the customized text, on our servers.
- Plan details: which BlogConnect plan the store is on, and the date the store first installed the app.
- Feedback the merchant sends through the app's feedback form: the question or idea, and a contact email if they give one.
- How the app is used: which of the app's pages are opened and which features are used, with the browser and device type and an approximate location based on the network (IP) address. We use this to fix problems and improve the app.
BlogConnect doesn't access the store's orders, customers, products or payments.
From readers who comment
- What a reader posts: their name, email address, the comment or reply, and any photos they add. These are saved in the merchant's Shopify store (photos in the store's Files). The name, comment and photos are shown on the blog. The email address is never shown publicly.
- Email notifications: when the store has notifications turned on, a reader gets an email when someone replies to them, and the store gets an email about new comments. These emails include the names and the comment text.
- Comments imported from Shopify: the store's existing Shopify blog comments, with their authors' names and email addresses, are copied into BlogConnect so they keep showing.
- Article views: when a reader opens an article with comments, the comment box reports the view: the store, the article, the website the reader came from, and whether it's their first view of that article in this browser session. It includes nothing that identifies the reader. The merchant sees the totals in the app's Analytics.
BlogConnect doesn't use cookies. The comment box keeps three small things in the reader's own browser: a copy of the article's comments for up to 30 minutes, so the page loads faster; the time of the reader's last comment, so the same browser can't post many comments in a row; and, until the tab is closed, a note that the article was already viewed, so views aren't counted twice.
Technical information
Like any website, our servers see the network (IP) address of each request. Our hosting provider records request logs that include IP addresses, and deletes them after one hour.
How we use information
Only to run BlogConnect for the merchant:
- to show comments and replies on the store's blog, and let the merchant moderate them;
- to send the reply and new-comment emails the store has turned on;
- to show the merchant how their articles are read;
- to provide the features of the merchant's plan;
- to answer feedback and support questions;
- to keep the app secure and working, and to fix and improve it.
We don't sell information, use it for advertising, or share it with anyone except the service providers below.
Service providers
- Shopify hosts the merchant's store, where comments, readers' names and email addresses, photos and most settings live.
- Vercel (United States) hosts the app.
- Neon (United States, AWS us-east-2) hosts our database.
- GitHub (United States) keeps a backup copy of each store's access token in a private repository that only we and our hosting provider's build service can read.
- Resend (United States) sends the notification emails.
- PostHog (United States) stores the app's usage and article-view analytics.
- Zoho hosts our email, so it holds any message you send to our support or privacy address.
How long we keep information
| Information | Kept |
|---|---|
| Access token | Until the app is uninstalled; deleted from our database and the GitHub backup straight away when it is. Earlier versions of the backup can still contain the old token, but Shopify cancels it when the app is uninstalled, so it no longer works. |
| Settings, customized text and feedback (our copy) | While the app is installed; deleted after uninstall as described below |
| The date the store first installed BlogConnect | After uninstall too, so the store's founding or legacy plan still applies if it reinstalls. |
| Usage and article-view analytics at PostHog | 1 year |
| Notification emails at Resend | 30 days |
| Request logs at our hosting provider | 1 hour |
| Emails you send us | As long as needed to answer you and keep a record of the conversation |
Comments, readers' names and email addresses, and photos are saved in the merchant's Shopify store. They stay there until the merchant deletes them or the store is closed.
Deleting your data
- Merchants: when you uninstall BlogConnect, the access token is deleted straight away. About 48 hours later Shopify asks us to delete the store's data, and we delete everything we hold for the store except the date it first installed BlogConnect. You can also email us to ask for deletion sooner.
- Readers: your comments, name and email address are stored in the store you commented on. Ask that store to remove them; deleting a comment in BlogConnect removes it, with your name, email address and photos. You're also welcome to contact us.
Your rights
Depending on where you live (for example under the GDPR in the European Union and the UK, or the CCPA in California), you may have the right to see, correct or delete information about you, or to object to how it's used. Merchants can contact us directly. Readers should start with the store, since the store decides how BlogConnect is used on its blog; you're also welcome to contact us.
For readers' information, the merchant is the controller and we process it on their behalf. Merchants are responsible for having a lawful basis to collect readers' names and email addresses through their comment form.
Security
Connections to the app use HTTPS. Readers' comments, names and email addresses stay in Shopify, protected by Shopify's security. Only our own servers use the app's Shopify access tokens; they're kept in our database and in the private GitHub backup described above. Access to our hosting is limited to Wyatt Chamberlin.
Children
BlogConnect is a tool for businesses. It isn't directed at children, and we don't knowingly collect information about children.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects how merchants' data is used, we'll tell merchants in the app or by email first.
Contact
Wyatt Chamberlin, Centaur Apps
Email: privacy@centaurapps.com