Privacy Policy

Tunnelbox Downloads is provided by Quantum Tunnel. The app processes store and buyer information to make purchased digital files available on behalf of Shopify merchants. Contact support@quantumtunnel.foundation about this policy or a data request.

Effective date: 14 November 2026

1. Information received from Shopify

The app requests read_products, read_orders, read_customers, read_merchant_managed_fulfillment_orders, write_merchant_managed_fulfillment_orders and write_app_proxy. Product access matches files to existing products and variants. Order and customer access identifies paid purchases and the buyer entitled to them, and updates access after refunds or cancellation. Fulfillment permissions support the optional automatic fulfillment setting. The app proxy permission serves buyer download pages inside the store.

Shopify provides product and variant identifiers, titles, handles, images and SKUs; order identifiers, order number, confirmation number, date, payment/refund/cancellation status and purchased line items; and, where available, the buyer’s email, name and Shopify customer ID. The app does not receive payment card numbers.

2. Information stored and its purpose

• Store and account records: the permanent store domain, permissions, installation dates, delivery and email settings, plan/usage information and Shopify billing identifiers. These run the installation, access settings and plan capacity checks.
• Authentication: Shopify sessions and access/refresh tokens, and any staff identity fields Shopify supplies with a session, authenticate administration and API calls. If a merchant creates app API keys, the app stores their hash, name, display prefix, creation, last-use and revocation dates, not the complete key.
• Content: uploaded files, file names, sizes, types, storage identifiers and any checksums; external URLs; product/variant mappings; CSV import rows, results and errors; and storage-inbox import paths and results. These create and maintain the merchant’s downloadable catalog. Do not put unnecessary personal information in file names, URLs or imported content.
• Buyer and order records: the order information above, digital line items, quantities and refunded quantities, file entitlements, fulfillment status/errors and access settings. A random order access token enables the buyer download page. These records deliver purchases and let merchants resolve access issues.
• Download history: an allowed download request records its time, order, file, IP address (when supplied by the proxy) and browser user agent. This enforces per-file download counts and shows activity to the merchant. It records the request before redirecting to storage or an external host, not proof that a complete file was received.
• Email history: app-email attempts store the recipient, time, delivery/resend type, sent/failed status, errors and provider message ID when available. A sent status means the email transport accepted the send, not that the buyer read it or that it reached their inbox. Shopify notification emails have a separate history managed by Shopify.
• Operations and support: background jobs store their type, identifiers/payload, status, attempts and errors. Application logs include webhook topics, store domains, job identifiers, processing counts/timings and errors. Error details can contain information about the request being processed. Support email contains the information you choose to send. These help operate the service and investigate problems. Restricted access-audit records store the store identifier, timestamp, action, authorization outcome and staff/API-key identifier when available. Offline Shopify sessions do not identify an individual staff member; buyer access records contain no buyer identifier.

3. Buyer access, files and email

Merchants can add a Digital Downloads block to Shopify’s thank-you and order-status pages. The block sends a Shopify session token, order ID and, when available, confirmation number to the app. The app checks order ownership using the confirmation number or authenticated customer identity before returning the buyer link. A storefront downloads list uses the customer identity supplied by Shopify for a signed-in buyer. An individual order link itself grants access; keep it private.

Hosted files use private storage and short-lived signed file URLs after access checks. Storage may use the application server’s disk or an S3-compatible provider, depending on deployment. An external file stays with the merchant’s chosen host: the app stores its URL and redirects the buyer there. That host receives the buyer’s request and handles it under its own privacy practices. App expiry, limits and revocation cannot invalidate an external URL already obtained or recall a downloaded copy.

App delivery email is optional and requires a configured SMTP transport and sender address. If unavailable, the app cannot send or resend it. Merchants can instead add the snippet in app Settings to Shopify’s order confirmation notification; Shopify then sends the notification containing an order ID and confirmation-number link. This requires merchant setup and is not an automatic app-email fallback.

4. Sharing and service providers

Shopify handles authentication, commerce data, notifications and platform events. Application hosting and database services process the records described above; the configured storage service processes hosted file bytes and file requests. If app email is configured, its provider receives the recipient and rendered message, including the buyer download link and any order/customer fields in the template. Merchants can see their store’s order and delivery history.

External file hosts are chosen by the merchant. Processing locations depend on the services involved and may be outside your country. Contact support for deployment-specific provider and location information. The app does not use these records for advertising or offer a data-sale feature.

5. Retention and deletion

While installed, the app retains settings, content and purchase entitlements to preserve buyer access. Expiring a download link or disabling access does not erase the purchase. When enabled by the operator, scheduled maintenance removes download IP/user-agent details and eligible terminal email, job and import history older than 30 days, and access-audit records older than 90 days. It defaults to disabled. Enabled processing runs hourly in bounded batches; backlogs can delay completion. Download-count events remain for lifetime limits.

• Deleting a library file removes its app record, mappings, past-order file entitlements and associated download events; the app also requests deletion of hosted bytes. Other order/email records remain. Removing an external link from the app does not delete content at the external host.
• After Shopify’s uninstall event is processed, the store is marked uninstalled, its stored Shopify sessions are deleted, and app-mediated buyer downloads stop. Content and order records remain pending Shopify’s shop-redaction event, generally sent about 48 hours after uninstall. This is not a guaranteed deletion deadline; delivery, processing errors or a reinstall can affect the timing.
• On an applicable shop-redaction event, the app requests deletion of the shop’s hosted files and inbox objects, then deletes the shop database record, associated settings, content/import records, API keys, orders, download/email events, erased-order suppression records, jobs and remaining sessions. A redaction for an earlier installation is ignored if the store has since reinstalled.
• Shopify customer-redaction events delete matching customer/order records within that store, including their line items, file entitlements and download/email events. A shop-specific keyed digest of each erased order ID and its shop-specific key are retained until shop deletion to prevent re-importing that order, not to block later purchases by the customer. Erasure does not remove shared merchant files, Shopify’s own records or buyer-held copies.

These deletion handlers target active application records and storage; they do not erase separately held server/provider logs, backups or support correspondence. Backup storage, encryption, retention and recovery procedures must be configured separately for each deployment; no scheduled backup service is provided by this repository. Contact support about deployment-specific retention or deletion. Restoring a backup requires re-applying completed erasure decisions before returning the service to use. Application access audits omit customer/order identifiers, returned content and delivery credentials; they are removed with the store.

6. Data requests and security

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing. Buyers should contact the merchant they purchased from; merchants can involve support@quantumtunnel.foundation for assistance. Shopify customer-data request events acknowledge receipt and log matching-record counts; they do not automatically fulfill the request or email an export. A Shopify-authenticated merchant can download matching stored order, item, download and email records through the export endpoint described on our support page, including fields absent from app histories. Delivery credentials are excluded. The merchant or support team must verify the requester and securely forward the appropriate records; downloading alone is not proof of delivery.

The app uses Shopify authentication, signature checks for platform webhooks and storefront proxy requests, and signed hosted-file links. Buyer links and confirmation numbers should be treated as confidential. No internet service can guarantee perfect security. If this policy changes, its effective date changes with it.