Skip to content
Gookit
Menu

Privacy Policy

Last updated:

On this page

Introduction

This Privacy Policy describes how Gookit (“we”, “us”) collects, uses, and shares information when you visit our websites or install or use BarcodeMan (the “App”) on BigCommerce, Shopify, WooCommerce, or Wix. The App lets merchants design, generate, and print barcode and product labels using data from their connected store.

Information we access from your store

Shopify

When you install the App on Shopify, we request the following access scopes. We only use this data to operate the labeling service for your store.

  • Products & inventory (write_products, read_inventory, write_inventory, read_inventory_transfers) — to read product titles, variants, images, barcodes, SKUs, and pricing so they can be placed on labels, and to write barcodes back to products you choose to update.
  • Orders (read_orders, read_all_orders, read_draft_orders) — to generate shipping, picking, and order labels from order data.
  • Customers (read_customers) — to render customer name and address on shipping labels when you choose to print from an order.
  • Locations & markets (read_locations, read_markets) — to filter inventory and label content per location or market.

We do not request access to payment methods, customer payment information, themes, script tags, price rules, or saved searches.

Wix

When you install the App on Wix, you grant the App owner-level access through Wix OAuth. The App reads your store catalog (products, variants, SKUs, prices, images, inventory) and orders (order numbers, items, customer name and address) to generate labels. The App does not access payment, billing, or site-builder data.

BigCommerce

When you install the App on BigCommerce, you authorize access through BigCommerce OAuth. The App reads your store profile and product catalog, including product and variant names, descriptions, images, prices, custom fields, SKUs, UPC/GTIN values, and inventory levels, to search, design, and generate labels. It can update SKUs and UPC values for variants you choose to change. The App also reads orders and their billing and shipping contact details, including names, companies, phone numbers, and addresses, to generate address and order labels. BigCommerce provides a store identifier and the installing user’s account ID and email so we can authenticate the installation and operate the App.

WooCommerce / WordPress

Connecting BarcodeMan requires accepting our Terms and this Privacy Policy, then approving WooCommerce's read/write authorization screen. Your store URL is sent to our API to start that flow. WooCommerce sends the resulting REST API credential directly to our API; the plugin stores a Site Account ID and a revocable plugin token in your WordPress database.

The WordPress.org version is a connector: labels are designed and printed in the BarcodeMan workspace at woocommerce.barcodeman.app, which opens in its own browser tab. You sign in there with an email address and password, which are sent to our identity service hosted by Supabase, and the workspace acts as that signed-in person. While a connection is being made, the plugin briefly publishes a one-time hash on your site so our API can confirm a site administrator started it; it contains no store or personal data. The Woo Marketplace version runs the app inside your WordPress admin instead and exchanges the stored values and your store URL for a short-lived app session.

We access products and variations, including names, images, prices, SKUs and barcode fields, and orders, including items and billing/shipping contact details such as names, addresses, email addresses and phone numbers, to provide the labels you request. We read store settings and WooCommerce version information for store configuration and compatibility. We write generated SKUs or barcodes back only when you choose to apply them. Label templates, uploaded images and generated files are processed by our service.

The WordPress.org version uses Stripe for paid subscriptions. Our API sends a Site Account ID in Stripe customer metadata, the customer ID, selected plan price and checkout return URLs. Stripe collects the payment details you enter at checkout. Product and order records are not sent to Stripe for subscription billing.

When you open the BarcodeMan home page and your store details have loaded, the workspace sends your site home URL (as the store identifier), store name (or your site hostname if no name is set), WordPress administrator email, platform, plan label and app version to Intercom to identify your store for support. Intercom also receives ordinary request information such as your IP address and browser details. No chat launcher is shown.

Information we collect from you

  • Account information — name, email, store URL, plan, and billing metadata for the operators of the App.
  • Usage and device data — IP address, browser, operating system, app version, and feature usage logs, used to operate the service and diagnose issues.
  • Support communications — the contents of messages, screenshots, and files you send us when you contact support.

How we use information

  • To provide, operate, and maintain the App.
  • To generate the labels and files you ask the App to produce.
  • To process subscription billing and prevent fraud.
  • To diagnose errors, improve performance, and develop new features.
  • To respond to your support requests and send service notices.

We do not sell personal information, and we do not use store or customer data for advertising.

Website analytics

We use Google Analytics on the Gookit marketing site, Help Center, and Blog only when you select “Accept analytics.” Before you accept, the Google Analytics script is not loaded and no analytics request is sent to Google. If you decline, analytics remains off.

After you accept, Google Analytics may collect the pages you visit, how you arrived at the site, approximate location, browser and device information, and interactions such as product, pricing, app-store, and download link clicks. Google Analytics uses a first-party _ga cookie containing a pseudonymous client identifier to distinguish users and sessions. We do not send names, email addresses, store data, customer data, form contents, or account identifiers in our analytics events. Advertising storage, Google signals, and ads personalization are disabled in our site integration.

We store your analytics choice in your browser’s local storage under gookit.analytics-consent.v1. You can change that choice at any time through “Analytics preferences” in the footer. If you withdraw consent, we disable new analytics tracking, attempt to remove the Google Analytics cookies for this site, and reload open site tabs that had loaded Google Analytics. Google may receive a final cookieless consent or lifecycle ping while a previously loaded tag shuts down. Google describes its own data practices in the Google Privacy Policy.

Service providers (sub-processors)

We share data with vetted providers strictly to operate the App. Each handles only the data needed for their function:

  • Supabase — primary database and storage.
  • DigitalOcean Spaces — storage and delivery of generated PDF labels, which can contain the product, customer or order details included in your template.
  • Firebase — authentication.
  • Amazon Web Services (S3) — storage of generated PDF labels and template assets.
  • PrintNode Ltd — delivery of Cloud Print jobs to the printer in your store. Used only when you turn Cloud Print on. It receives the label file being printed, which may contain product, customer, and order information rendered by your template, such as names and addresses. It also receives an internal store identifier and technical information about the connected computer and its printers. It does not receive your Shopify or Wix credentials, or customer and order records separately from the rendered label file.
  • Cloudflare — content delivery and routing.
  • Google Analytics — optional website traffic and conversion measurement, enabled only after a visitor accepts analytics.
  • Stripe — subscription billing and payment processing.
  • Sentry — error and performance monitoring, and session replay in the BarcodeMan app. Replay records a sample of sessions, plus sessions where an error occurs, and can include what is on screen, such as product names, customer names and addresses shown on labels, and uploaded images, along with your IP address and browser details.
  • Intercom — identifies your store for support and handles support email; no chat launcher is shown. When you open the App’s home page and your store details have loaded, it receives your store identifier, store name, contact email, platform, plan label and app version, plus ordinary request information such as your IP address and browser details. See its Privacy Policy and Terms.
  • Formspree — delivery of optional in-app support form submissions. When you submit a form, it receives your name, email, message, selected attachments, platform, app version, store identifier and any support topic, plus ordinary request information such as your IP address. See its Privacy Policy and Terms of Service.
  • Google Fonts — font stylesheets and files requested by your browser when the connected WordPress app opens. Google receives your IP address and request headers. See the Google Privacy Policy.
  • Bytescale — image and template uploads.

We may also disclose information when required by law, to enforce our terms, or to protect the rights, property, or safety of our users or the public.

Data retention

We retain account, billing, and operational records for as long as your account is active. Generated label files and job history are retained for up to 12 months and then purged. For platform integrations that notify us of uninstallation, we delete or anonymize merchant and customer data within 30 days, except where we are required to keep it longer for legal or accounting reasons.

Deleting the WordPress plugin does not notify our service to delete your account or cancel a subscription. The Woo Marketplace version removes its local plugin token and pending connection state but retains the Site Account ID, so a reinstall can reconnect to the same account. The WordPress.org version clears its pending connection state but keeps both the Site Account ID and the plugin token, so a reinstall can prove the original connection; use Disconnect before deleting it to revoke workspace access. Deleting either version does not revoke the current WooCommerce REST API authorization. You can revoke that authorization in WooCommerce settings and request deletion of service-account data by contacting hi@gookit.co. Manage or cancel your paid plan in BarcodeMan before deleting the plugin.

Your rights

Subject to applicable law (including the GDPR and CCPA), you may request to access, correct, export, or delete the personal information we hold about you. To make a request, email hi@gookit.co.

Shopify merchants and their customers can also exercise data rights through Shopify’s mandatory data request and erasure flows. We respond to Shopify’s customers/data_request, customers/redact, and shop/redact webhooks within the timeframes Shopify requires.

Security

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest, access controls, and audit logging. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you as required by law.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or applicable law. The “Last updated” date above shows when this policy was most recently revised. Material changes will be communicated before they take effect.

Contact us

For privacy questions, requests, or complaints, contact hi@gookit.co. The App is operated by Gookit.