Genie AppsGenie Apps Help Center

Privacy Policy

Store Pickup by Genie Apps — Last updated August 25, 2026

“Store Pickup by Genie Apps” (the “App”) is operated by Genie Apps (“we”, “us”, or “our”). The App provides in-store pickup and local delivery scheduling for Shopify merchants, including an optional Google Calendar integration. This Privacy Policy applies to the App that is submitted for Google OAuth verification and describes how personal information — including Google user data — is collected, used, stored, shared, protected, retained, and deleted.

Personal Information the App Collects

When you install the App, we are automatically able to access certain types of information from your Shopify account:

1. Read and Write Orders

We pull the order information from stores and update the tag if the order is an in-store pickup. Based on those tags we are able to show in-store pickup orders in the app.

2. Read and Write Themes

We request the above permission to add the App's code directly into your theme. This is required to make the installation process smooth for merchants so they don't have to add code manually.

3. Read and Write Products

We create a pickup product on installation of our app. Whenever a customer selects the in-store pickup option, the pickup product is automatically added to the cart. Based on that pickup product, the free pickup option automatically appears and is selected at checkout.

4. Read Shop Information

Shopify provides basic shop information such as the shop's name, email, store owner's name and email. We save this information to customize the app and to identify customer service requests.

Google Calendar and Google User Data

Google Calendar is an optional feature. We access Google user data only after a merchant explicitly connects their Google account from Settings → Integrations in the App. Connecting Google Calendar is not required to use Store Pickup.

Google user data we access

When you connect Google Calendar, we request only this Google OAuth scope:

  • https://www.googleapis.com/auth/calendar.events — create pickup and delivery appointment events on the primary Google Calendar of the connected account. The App only sends create (POST) requests to Google; it does not list, read, update, or delete existing events.

We do not request calendar.readonly, full calendar access, Gmail, contacts, Drive, or other Google services. We do not read existing calendar events, attendee lists, or other people's calendars, and we do not add attendees through the Google Calendar API. We only create new events on the connected account's primary calendar when a pickup or delivery order is placed.

The Google user data we access, use, or store is limited to:

  • OAuth credentials issued by Google (access token, refresh token, and token expiry time) so the App can create events on your behalf.
  • Calendar events we create on your primary calendar, including event title, date/time, location, and description. We do not store copies of those events on our servers after they are created in Google Calendar.

Event descriptions may include order details already present in your Shopify store (order number, customer name, email, phone, address or pickup location, order total, and line items) so your team can fulfill the appointment.

How we use Google user data

After you connect Google Calendar, our application will access your Google Calendar to create appointment events on your behalf. We will use your Google user data to provide you with the services you requested — specifically, creating pickup and delivery events on your primary calendar and keeping the connection working by refreshing your access token.

We use Google user data solely to provide and improve user-facing features of the App:

  • Create pickup or delivery appointment events on the merchant's connected Google Calendar when a qualifying order is placed.
  • Refresh the Google access token when it expires so event creation continues to work.

When Google Calendar is connected, we may also email the customer a calendar invite (.ics file) and an “Add to Google Calendar” link. That email uses Shopify order and customer details. It does not use the merchant's Google OAuth tokens and does not access the customer's Google account.

We do not use Google user data for advertising (including targeted, personalized, retargeted, or interest-based ads), selling to data brokers, determining credit-worthiness, lending purposes, creating databases, or any purpose other than providing or improving the calendar features described above. We do not transfer, sell, or use Google user data to create, train, or improve a machine learning or artificial intelligence model beyond a specific user's personalized model for this user-facing feature (and we do not build such models from Google user data).

Our employees, agents, contractors, and successors do not read Google user data unless you have given affirmative agreement to view specific data, it is necessary for security purposes (for example, investigating a bug or abuse), it is necessary to comply with applicable law, or the data is aggregated and anonymized for internal operations.

Google API Services User Data Policy (Limited Use)

Store Pickup by Genie Apps' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace APIs will adhere to the Google Workspace User Data Policy, including the Limited Use requirements.

AI/ML model training

Store Pickup by Genie Apps does not retain user data obtained through Google Workspace APIs to develop, improve, or train non-personalized AI and/or ML models. Google Workspace APIs are not used to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

How we store Google user data

OAuth access and refresh tokens, plus the token expiry time, are stored encrypted on the merchant's shop settings record for as long as Google Calendar remains connected. The App does not store Google Calendar event IDs or copies of events after they are created. Events exist only in the merchant's Google Calendar.

Sharing, transfer, and disclosure of Google user data

We do not sell Google user data. We will not sell your data to third parties, but we may share it with infrastructure partners who help us provide our services (for example, hosting), solely to operate the App. We do not transfer or disclose Google OAuth tokens to other apps or advertising platforms. Event details written to your Google Calendar are visible in that Google account according to your Google Calendar sharing settings. We may disclose information if required to comply with applicable laws, a lawful request, or to protect our rights. Google processes Calendar data under Google's own terms and privacy policy when you use Google's services.

Data Security and Protection

Security procedures are in place to protect the confidentiality of your data, including sensitive information and Google user data. We use encryption to protect your information. Google OAuth tokens are encrypted at rest on our application servers and are not exposed in the storefront or to other merchants.

  • Encryption in transit: all communication with Google APIs uses HTTPS/TLS (including OAuth token exchange, token refresh, and calendar event creation).
  • Encryption at rest:Google access tokens and refresh tokens are stored encrypted on the merchant's shop settings record. We do not save copies of calendar events returned by Google.
  • Access controls: access to Google user data is limited to authorized employees and systems that need it to operate, maintain, and support the App, on a least-privilege basis.
  • Infrastructure: the App runs on secured cloud infrastructure with authenticated administrative access.

If we become aware of a security incident that affects your personal information, we will take steps to contain the incident and notify affected users and regulators as required by applicable law.

Data Retention and Deletion

We store your personal information for a period of time that is consistent with our business purposes. We will retain your personal information, including Google user data, for the length of time needed to fulfill the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law. When the data retention period expires for a given type of data, we will delete or destroy it.

  • While Google Calendar is connected: we retain OAuth tokens only for as long as the integration remains enabled, so the App can create appointment events.
  • If you disconnect Google Calendarin Settings → Integrations, we immediately disable the integration and delete the stored Google access token, refresh token, and token expiry data from our servers. Events already created in your Google Calendar remain in your Google account until you delete them there.
  • If you uninstall the App from Shopify, we delete the shop record and associated Google Calendar credentials from our servers when we receive the uninstall notification.
  • If you revoke access from your Google Account permissions page, the App can no longer create calendar events. Stored tokens become unusable and are deleted when you disconnect, uninstall, or request deletion.

You may request for your data to be deleted by emailing genieexperts@gmail.com. You may also request that your data be corrected or exported at the same address. We will process verified deletion requests within 30 days. Calendar events that already exist in Google Calendar must be deleted from that Google account by the calendar owner; we cannot delete events from your Google account after you revoke access.

How Do We Use Your Personal Information?

We use the personal information we collect from you and your customers in order to provide the Service and to operate the App. Additionally, we use this personal information to communicate with you and to optimize or improve the App.

We may use merchant contact information obtained from Shopify (such as shop email) to send you information about our products or services. We do not use Google user data for advertising or marketing of any kind.

Sharing Your Personal Information

We do not transfer or disclose your information to third parties for purposes other than the ones provided in this Privacy Policy. We may share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights. We do not transfer or disclose Google user data to third parties except as described in the Google Calendar section above, or as required by law.

If you are a European resident, you have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. Please note that your information will be transferred outside of Europe, including to Canada and the United States.

Changes

We may update this privacy policy from time to time in order to reflect changes to our practices or for other operational, legal, or regulatory reasons. If we change how we use Google user data, we will update this policy and notify users as required before using that data in a new way.

For more information about our privacy practices, or if you have questions or a complaint, please contact us at genieexperts@gmail.com or by mail at:

424-E Gulshan e Ravi, Lahore, Punjab, Pakistan