Privacy Policy

Last updated 3 November 2026

This policy covers the Shopify app Easy PDF Flipbook & Preview, published by Joykek. It is written to be read, not to be survived.

What we store

• Your shop domain and the access token Shopify issues, so the app can talk to your store. Tokens are stored encrypted at rest by our database host and are never shown in our interface.
• Your settings: button label, colours, size, placement, viewer options, language and which plan you are on.
• A reference to each PDF: the file identifier, its public address, the title you gave it, its size, and which products it is attached to. If you chose Easy PDF storage, also the file itself (see below).
• Panel usage events: which screens you open in the app, whether the upload, preview and product link steps finished (with a timestamp), and whether the button appeared and opened when you view your store from the app. We use them to find and fix where setup gets stuck. They contain no file names, titles, email addresses or shopper data. We keep at most 500 per shop; a new event replaces the oldest. When you uninstall, a summary of the last 30 events also goes into our internal notification email; that email is not removed automatically by the shop redaction request, and we will delete it if you email us.

If you turn on a lead form

The lead form is optional and turned on per PDF. On that PDF, the reader's email address, name if you asked for it, the consent text they saw and the consent date are stored on your behalf, with the PDF name and the record date. We do not record an IP address, browser data or a Shopify customer ID with them.

You, the merchant, are the data controller for this data. Joykek processes it only on your instructions, does not use these records for its own purposes and does not email anyone. Telling your readers in your own privacy policy, and getting marketing consent where required, is your responsibility.

How it gets deleted: from the Leads screen in the app you can delete records one by one or in bulk and download them as CSV. A Shopify customer redaction request (customers/redact) deletes that email's records in that store. When you uninstall, records stay until Shopify's shop redaction request (normally 48 hours) and are deleted with it. Changing plan or deleting the PDF does not delete them. Readers make requests to the merchant; if they reach us we refer them to the merchant.

What we do not store

• No shopper personal data outside the lead form. Not addresses, not order contents, not Shopify customer records; the app does not read Shopify customer data. Readers are asked for nothing unless you turn on a lead form on a PDF. When someone tries a password or sends a form, the IP address is kept in memory for at most 10 minutes to limit abuse. It is never written to the database or logs.
• No hidden copies of your PDFs. In both cases the file is uploaded straight from your browser to its destination and read straight from there by the viewer; the binary never travels through our servers and is never written to our application server's disk. When you choose Easy PDF storage the file is kept in our object storage (below) - beyond that we keep no copies of your PDFs.
• No person-level tracking on your storefront. The app sets no cookies for your shoppers and loads no third party trackers. A reader who fills in a lead form gets a signed marker in browser storage (localStorage), per PDF and not identifying them, so that PDF does not ask again for 30 days. Reader statistics are daily totals per document (opens, page views, PDF link clicks, Add To Cart). They contain no IP address, cookie, customer ID or browser data and cannot be tied to one person. They are deleted with the store redaction request.

Permissions we ask for, and why

• read_products, write_products - to list your products and to write the flipbook setting onto the products you choose.
• read_files, write_files - to place your PDFs into your own Shopify Files and read them back.
• read_themes - only to check whether the app has been switched on in your theme, so the setup checklist can tell you the truth.

Where the data lives

On Joykek infrastructure in the European Union (Hetzner, Nuremberg, Germany). Your PDFs live wherever Shopify keeps your files, or - if you chose Easy PDF storage - in Cloudflare R2, Western Europe region.

How long we keep it

For as long as the app is installed. When you uninstall, Shopify sends us a shop redaction request, normally after 48 hours, and we delete your settings, your PDF records and your panel usage events. PDFs in your Shopify Files are not touched - they are yours and they stay where they are. Files in Easy PDF storage are permanently deleted with that request, and are deleted immediately when you delete a PDF inside the app.

We also handle Shopify's two customer privacy requests. The only shopper data we hold is lead form records: a redaction request deletes that email's records, and for a data request the merchant finds and downloads them by email in the app. In a store that does not use the lead form there is nothing to hand over or erase.

Who else sees it

We do not sell, rent or share your data for marketing. The only processors we use are the ones that run the service: Hetzner (Germany) for hosting and the database, Cloudflare R2 (Western Europe) for file storage if you chose Easy PDF storage, and Google Workspace for delivering email: your messages from the support form, the setup emails we send you and our internal install and uninstall notices, which can include your panel usage events. There are no others.

One thing you should know

File addresses - both Shopify's and ours - are not secret. The address of a PDF in Shopify Files contains its file name, so anyone who knows or guesses the name can reach it; a password or lead form does not stop that, they are only reading gates. Anyone who has the link can open the file, and that stays true even after you hide or delete the PDF in the app, because a link that has been copied cannot be recalled. A file you delete may still open for a short while because of content delivery network caching. This app is built for product previews. Do not use it to distribute paid, private or members-only documents.

Your rights

You can see and change your settings, PDF records and lead form records from inside the app, and you can delete any of them. Panel usage events are not shown in the app; email us and we will send or delete them. If you want a copy or a deletion in writing, email us and we will handle it.

Contact

Joykek - info@joykek.com
Bağdat Cad. 399, Suadiye, Istanbul, Türkiye

Back to the homepage