Runway Privacy Policy
GrtLabs Inc (“GrtLabs,” “we,” “us”)
10101 Southwest Fwy #431, Houston, TX 77074
[email protected] · (713) 714-6849
Effective date: October 16, 2026
This policy describes how we handle information when you use Runway, our free, read-only inventory and reorder report apps for BigCommerce and Shopify (together, the “Apps”). The Apps help store owners see stock levels, sales velocity, and days-of-cover estimates. They do not change your catalog, inventory, or orders.
Who this applies to
This policy applies to merchants who install or use Runway on their BigCommerce or Shopify store. It does not describe the privacy practices of BigCommerce or Shopify themselves; those platforms have their own policies.
Information we access from your store (not stored as a product catalog copy)
When you open Runway, our servers call the platform APIs on your behalf to build the report at that moment. We do not maintain a separate long-term database of your product catalog or sales report rows.
Depending on which App you use, we may read:
| Category | BigCommerce App | Shopify App |
|---|---|---|
| Products & variants | Product names, variant options, SKUs, product and variant IDs | Product titles, variant titles, SKUs, product and variant IDs |
| Inventory | Inventory by location (when your store grants inventory access), totals | Inventory levels by location, totals |
| Sales / orders | Order line items: SKUs, product and variant IDs, quantities, and order dates (for 30/60/90-day totals). We use a filtered set of order statuses. | Aggregated units sold per SKU via Shopify sales reports. Shopify may require additional approval before sales data is available in production; until then, sales data may be unavailable while inventory still loads. |
| Locations | Location names for inventory columns | Location names for inventory columns |
Customer personal data: Runway is built for merchant inventory reporting. We do not store your customers’ names, email addresses, shipping addresses, or payment details. BigCommerce order data may pass through server memory briefly so we can read line items; we do not save customer fields. Shopify sales figures come from aggregated sales reports by SKU, not from customer profiles.
Information we store
BigCommerce
We keep store-level data only:
- Store ID
- OAuth access token, encrypted at rest in our database
- OAuth permissions and install information returned at install (such as BigCommerce user or owner metadata)
- Reminder settings you save in the App: days-of-cover threshold and reminder frequency
- Session cookie: a signed, HTTP-only cookie for embedded admin access (store reference and user id; not your platform access token)
We do not store BigCommerce customer personal data.
Shopify
- Shop domain (for example, your-store.myshopify.com)
- OAuth access token, encrypted at rest in our database
- OAuth permissions
- Login session records for the Shopify app. These may include staff user fields from Shopify (such as name or email) for admin login. We do not store your buyers’ personal data in Runway.
We do not sell your data.
How we use information
- Authenticate you and connect to your store
- Compute and display inventory runway reports and CSV exports
- Remember your in-app settings (BigCommerce reminder preferences)
- Operate, secure, and troubleshoot the Apps
Where data is hosted
We host application and database data in the United States on Railway.
Retention and deletion
- Report data (SKUs, inventory, sales totals in the UI or CSV) is computed on each request and is not kept as a standing copy in our database afterward.
When you uninstall:
- BigCommerce: Uninstalling the app deletes that store’s data from our database, including the encrypted access token and reminder settings.
- Shopify: We handle Shopify’s mandatory customer
privacy webhooks and uninstall notifications as follows:
- Customer data request and customer data erasure: We receive and handle these requests. Runway does not store customer personal data, so there is no customer information for us to export or delete beyond acknowledging the request.
- App uninstall and shop data erasure: We delete that shop’s data from our database, including login sessions and the encrypted access token for that shop.
If you need help with deletion, contact [email protected] or (713) 714-6849.
Cookies and similar technologies
- BigCommerce App: Uses a session cookie for embedded admin access after you sign in through BigCommerce.
- Shopify App: Runs embedded in Shopify Admin; session handling uses Shopify’s app session mechanisms and our database.
Security
We use HTTPS for production traffic. Store access tokens are encrypted at rest in our database. We avoid logging secrets and tokens in production-oriented code paths. No method of transmission or storage is 100% secure.
Subprocessors and platforms
- Railway — application and database hosting (United States)
- BigCommerce — platform APIs and OAuth (BigCommerce App only)
- Shopify — platform APIs, OAuth, and embedded admin (Shopify App only)
We do not use your store data for advertising or sell it to third parties.
Children
Runway is a business tool for merchants. It is not directed at children under 13, and we do not knowingly collect personal information from children.
Changes
We may update this policy. We will post the revised version at https://grtlabs.com/apps/runway/privacy/ and update the effective date at the top.
Contact
GrtLabs Inc
10101 Southwest Fwy #431, Houston, TX 77074
Email: [email protected]
Phone: (713) 714-6849