Privacy Policy

Last Updated 7 August 2026

Bones — Blog Composer (“Bones”, “the extension”) is a Chrome extension that adds a visual composer to the Shopify blog post editor. This policy explains what data the extension handles and what it doesn’t.

The short version: your writing stays in your browser. Bones has no analytics, no tracking, and no interest in your content. The extension makes exactly three kinds of network request, all described below, and none of them carries your article.

WHAT BONES DOES WITH YOUR CONTENT

Everything you compose in Bones happens locally, inside your browser, on the Shopify admin page you already have open:

  • The extension reads the existing article content from the Shopify editor on the page, and writes your composed content back into that same editor. It does this in the page itself, the same way you would by typing.
  • While you compose, your draft exists only in your browser. It is not transmitted, stored, or copied anywhere by the extension.
  • Bones does not use the Shopify API. It has no access to your store’s products, orders, customers, themes, settings, or anything beyond the editor content on the blog post page you are viewing.
  • Your article content is never sent anywhere by the extension. Not to us, not to anyone.

WHAT BONES SENDS OVER THE INTERNET

Three things, and only these three.

  1. Licence verification.

When you activate a licence key, and periodically afterwards to confirm it is still valid, the extension sends three pieces of information to our licensing system at storegrowthworks.com:

  • your licence key,
  • a device identifier — a random string the extension generates the first time it runs and keeps in your browser’s local storage. It is not derived from your computer, your browser, or you; it is a random value with no meaning outside our licence records. It exists so that one licence can be limited to three browsers. It does not identify you personally, and we do not use it to track you.
  • the store identifier described in point 3 below — so we can tell how many people who try Bones go on to buy it. Because this is attached to your licence, and your licence is attached to the email address you purchased with, this identifier is linked to your customer record from the moment you buy. Before then, during your free trial, it is not linked to anything about you.

As with any web request, our server also sees your IP address. We use it only to rate-limit the licence endpoint so keys cannot be guessed by brute force. It is hashed into a short-lived counter and is not stored and not logged against your licence.

This request does not include your article content, your store data, or your browsing activity.

  1. Product lookup — only when you ask for it.

If you add a Product Card block and paste a product URL, the extension fetches that product’s public information (its title and image) directly from the storefront address you pasted, so it can build the card. This request goes to that store — usually your own — and not to us. We never see it. It happens only when you paste a product URL, and never otherwise.

  1. The free-trial check.

Bones is free for 7 days per Shopify store. So that the trial belongs to your store rather than to one browser, the extension asks our server when your store’s trial began. It sends one value: a SHA-256 hash of your store’s handle — the “your-store” part of the admin.shopify.com/store/your-store/ address you are already on.

  • We do not receive your store’s name. A hash is one-way; we store only the hash.
  • We do not receive your store’s data, your products, your orders, or anything else about it.
  • This is the whole request. Our server replies with how much of your trial is left.

This exists so that the free trial works the way it reads: 7 days for your store, not 7 days per browser. It also means the trial follows you — using Bones on a second computer, or clearing your browser, no longer costs you the days you have left.

Once you buy a licence, this identifier is stored alongside it (see point 1), which lets us measure how many trials become purchases and spot customers who paid but never got the extension working. During the trial it is stored on its own, connected to no name, email address or account.

Beyond those three, Bones does not:

  • collect analytics or usage statistics
  • log errors to a remote service
  • track which sites you visit
  • send your content anywhere
  • use cookies
  • load remote code or advertising
  • phone home on a schedule for any purpose other than the licence check described above

One thing worth being precise about: when a product image or a video embed appears in the composer, your browser loads that file from wherever it is hosted — the Shopify CDN, or a video host such as YouTube — exactly as it would on any ordinary web page, and subject to that host’s own policies. The extension does not send those hosts anything about you beyond the ordinary request your browser makes for the file itself.

WHAT BONES KEEPS IN YOUR BROWSER

The extension stores three kinds of small value in your browser’s local storage, on the Shopify admin domain. They stay there when you close the tab, and they never leave your browser except as described above:

  • Your licence key and its last known status — so you don’t have to re-enter it, and so the extension works without asking our server every time.
  • How much of your free trial is left, for each store you use Bones on — a copy of the answer from our server, so the extension doesn’t have to ask on every use.
  • The random device identifier — to count browsers against your licence’s three-browser limit.

Your article drafts are not among them. Clearing your browser data removes all three, and costs you nothing except re-entering your key. Two notes: a cleared device identifier is treated as a new browser and takes up a seat until the old one expires after 30 days; and because the trial belongs to your store rather than your browser, clearing this data does not restart your free trial — but nor does it end one early.

PURCHASES

Purchases are handled by Paddle (paddle.com), our merchant of record, on their checkout pages — not inside the extension. When you buy Bones, Paddle collects the information needed to process the payment (such as your name, email address, and payment details) under its own privacy policy: https://www.paddle.com/legal/privacy

When your purchase completes, a customer account is created for you on storegrowthworks.com using the email address from your purchase, and your licence key is attached to it — so you can log in and retrieve your key at any time.

The extension itself never sees or handles your payment details.

DATA WE STORE

We (the developer) hold:

  • the customer record created when you purchase — your email address, your licence key, and your customer account on storegrowthworks.com;
  • the device identifiers seated against your licence, with the dates first and last seen, so the three-browser limit can be counted;
  • one trial record per Shopify store — the hashed store identifier and the date that store’s trial began. During a trial this is held on its own, with no name, email address or account attached to it;
  • for stores that go on to buy, a link between that hashed store identifier and the licence, so we can measure how many trials become purchases;
  • the payment records Paddle holds as merchant of record, under its own policy.

We use this to verify licences, let you recover a lost key, enforce the browser limit, run the free trial, understand how many people who try Bones go on to buy it, and provide support. We do not sell or share this information. We only send marketing email if you opted in at checkout, and you can unsubscribe at any time.

Retention. A device identifier is deleted automatically once it has gone 30 days unseen. Cancelled or revoked licence records are deleted automatically after 13 months of inactivity. A trial record is deleted automatically after 24 months without the store being seen. You can ask us to delete your customer record and licence at any time — see below.

PERMISSIONS

Bones runs only on your Shopify blog post admin pages (admin.shopify.com/store/*/content/articles/*). To work on those pages it needs access to them, which Chrome shows when you install as permission to read and change your data on that address — the standard notice for any extension that acts on a page. That single address is the whole of Bones’ access.

Bones asks for nothing else: no broad permissions, and no access to your other tabs, your history, your bookmarks, or any other website. It cannot read other sites you visit, because it is never loaded on them.

YOUR RIGHTS

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email bones@storegrowthworks.com and we will action it. Deleting your licence record means the licence stops working, so we’ll confirm before doing it.

We are based in the United Kingdom and handle personal data under the UK GDPR. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

CHILDREN

Bones is a business tool for Shopify store administrators and is not directed at children.

CHANGES TO THIS POLICY

If the extension’s behaviour changes in a way that affects this policy, we will update this page and the “Last updated” date before the change ships.

WHO WE ARE

Bones — Blog Composer is developed by Daniel Barrett T/A Store Growth Works.

Questions about this policy, or any request about your data: bones@storegrowthworks.com