Privacy Policy
Effective September 21, 2026
MyShapp is operated by Chrono Travel, LLC, an Oregon limited liability company (“MyShapp,” “we,” “us”). MyShapp is a tool that puts customers in touch with small, independent local businesses (“shops” or “sellers”), on the website at myshapp.com and in the MyShapp apps for iPhone and Android. We don’t make, sell, deliver or take payment for anything listed; we pass information between the two sides so they can do business with each other. This policy explains what information we handle to do that, who sees it, and the choices you have.
- We collect what’s needed to run accounts, shops, orders and conversations — and nothing for advertising. No ads, no advertising or analytics trackers, and we don’t sell or rent your information.
- MyShapp is the go-between. When you order from a shop, message it or ask it for something, that shop sees your name, email and what you sent, because it has to act on it. Each shop is an independent business and is responsible for how it uses what it receives.
- Location is used roughly — to about half a mile — to show shops near you, and isn’t stored unless you save an area or a delivery address yourself.
- You can delete your account yourself, in the app or on the website, at any time.
1. Our role
MyShapp provides the tools — storefronts, order and request forms, carts, messages and notifications — through which customers and shops find and deal with each other. Every sale, booking, delivery, payment and conversation is between the customer and the shop. MyShapp isn’t a party to it and doesn’t decide it.
That shapes how information moves. What you give a shop through MyShapp is given to that shop so it can serve you; once the shop has it, the shop is responsible for what it does with it (section 5). What we keep, we keep to run the service, keep it safe and keep a record both sides can rely on.
2. What we collect
Your account
- Email and password. Passwords are stored only as a salted, one-way hash; we can’t see them.
- Sign in with Google, Apple or Facebook The provider tells us an account identifier and your email address — a private relay address if you use Apple’s “Hide my email.” We don’t receive your password, contacts or posts.
- Account records: whether your email is confirmed, which sign-in methods are connected, and sessions that keep you signed in.
- Your agreement to our Terms: which version of the Terms of Service you agreed to and when, and, if you opt out of arbitration, that you did. We keep this as the record of what we agreed with you.
- When you create an account we record the IP address and the type of device and browser used, to help detect fraud and repeated abuse.
- Your name, if you add it to your account or with your first review: used on your orders, and shown on your reviews as your first name and last initial. You can change it on your account page at any time, and your reviews change with it.
- Your preferences: the name you use on orders, which payment app you usually pay with (just its name, such as “Venmo”), a rough home area if you save one, and the shops you save.
Shops (published by sellers, and public)
Sellers choose what to publish, and published shop information can be seen by anyone: business name, story, category, photos, products and prices, hours, pickup and delivery terms, a public address or approximate area and an optional map pin (exact or rounded, as the seller chooses), deals, a punch card, ways to pay (such as a Venmo or Apple Cash name), and any phone number, email or social links the seller adds. Sellers may also list credentials they hold; these are the seller’s own statements and we don’t check them.
Buying, booking and asking
- Orders — ordered ahead, bought from a self-serve cart, or held from a cart for later: your name, email, what you chose, the pickup day or time, any tip, deal or reward applied, what you’ve said about paying, and the order’s status as it changes.
- Custom requests and bookings: what you ask for, the dates or times, and the shop’s reply or quote.
- Reviews: your rating and comment. Reviews are shown publicly under your first name and last initial (for example “Maria G.”), taken from the name on your account; your full name and email are never shown with them.
- Punch cards: which of a shop’s punch cards you’ve earned punches on, from finished purchases.
- Private links: each order and request has a private link; we store only a scrambled form of its key.
Messages and pictures
Customers and shops can message each other about an order, request or booking, and can send pictures. We store those conversations so both sides can see them. We don’t read them, except when one is reported to us, when we need to investigate abuse, or when the law requires it. Sellers can also post in a trade room shared with other sellers; those posts are visible to the sellers taking part.
Delivery addresses
If you choose delivery, you give us the address and any instructions for the door. They are sent to the shop you ordered from so it can deliver. If you tick “save this address for next time,” we keep that address — including its exact point on the map, so the distance can be worked out — on your account until you change it, clear it or delete your account. A saved delivery address is never used to place you on a map or to decide what you see in Discover.
Location
Discover shows only shops within a limited distance of you. With your permission, your device sends us its location rounded to about half a mile; we use it for that request and don’t store it. You can save a rough home area instead, which we keep only in that rounded form. You can decline location at any time.
References, vouches and meetings
A seller can invite people who know them to act as references, or customers to vouch for them. That invitation sends us the person’s name and email (and phone, if given), which we use to contact them once. What they write, and whether their number may be shown, is their choice. Arrangements to meet a seller before booking are kept with the booking.
The phone apps
If you allow notifications, your phone gives us a notification token — an address that lets Apple or Google deliver order alerts to that phone. We keep it until you turn notifications off, sign out, or delete your account. The Scan tab uses your camera only while you’re scanning a code; the picture isn’t sent to us, only the web address inside the code.
Payments
You pay shops directly — through Venmo, Cash App, Zelle, PayPal, Apple Cash, a shop’s own website, or in person. MyShapp doesn’t receive, hold or process that money and never sees your bank or card details. We keep only the amounts, what was asked for up front, and what each side has said about whether it was paid. If online card payment through Stripe is offered in future, Stripe will handle it on its own checkout page, and we will keep only the payment’s status and amount.
Technical information
- IP addresses are used briefly to limit repeated sign-in and form attempts, appear in our hosting providers’ standard logs, and are recorded with account sign-ups and reports to fight fraud.
- Reports: when you report a shop, a message or a post, we keep the reason, what you wrote and any email you give.
- Featured-shop counts: when a featured shop is shown or tapped, your browser sends a random identifier for that visit so we can count each once a day. These counts aren’t linked to your account and are deleted after 90 days.
- Email and notification records: who we sent to, the subject, when, and whether it was delivered. The text of an email is erased once it has been delivered or can no longer be sent.
Cookies and storage on your device
| Name | Purpose | How long |
|---|---|---|
| myshapp_session (cookie) | Keeps you signed in. Strictly necessary. | 7 days, or until you sign out |
| myshapp_oauth (cookie) | Protects a Google, Apple or Facebook sign-in while it’s in progress. | 10 minutes |
| Bag, drafts and settings (device storage) | Remembers your bag, an unfinished shop setup and small display choices on this device. | Until you clear it |
We don’t use advertising, analytics or social-media tracking cookies.
3. How we use it
- To run MyShapp: show shops, pass orders, requests, bookings and messages between customers and shops, send receipts, updates and notifications, and let sellers manage their shops.
- To send account emails: confirming your address, resetting a password, and notices about your orders, requests, payments and reviews. We don’t send marketing email.
- To keep MyShapp safe: prevent fraud, abuse and unauthorized access, look into reports, and enforce our Terms of Service.
- To show sellers simple totals about their own shop, and to understand, at an overall level, whether MyShapp is being used.
- To comply with the law and respond to lawful requests.
We don’t sell personal information, share it for targeted advertising, or use it to build advertising profiles.
4. Who sees it
- The shop you deal with. When you order from, message, book or ask a shop, that shop sees your name, email and what you sent — and your delivery address and door instructions if you chose delivery. That is the point of sending it.
- The customer a shop deals with. A customer sees the shop’s public details, its replies, and the payment details the shop provides once it accepts an order.
- Everyone. Published shop information, and reviews under the reviewer’s first name and last initial, are public.
- Other sellers see trade-room posts.
- Service providers who work for us and may handle information only to provide their service: Hostinger (website hosting and email delivery); Google Cloud (a standby server and backup copies); Apple and Google (delivering phone notifications through Apple Push Notification service and Firebase Cloud Messaging); Google, Apple and Meta (sign-in, only if you choose it); OpenStreetMap and Google Maps (map images and place search, which receive your IP address, the area being viewed and any address you type into a search).
- Links you follow — a shop’s website, social profile, payment app or checkout page — are run by others, under their own privacy policies.
- Legal and safety. We may disclose information if the law requires it, or where we believe in good faith that it is needed to protect the rights, property or safety of MyShapp, our users or others.
- Business changes. If MyShapp is involved in a merger, acquisition or sale of assets, information may transfer as part of it, subject to this policy.
5. What shops do with your information
Shops on MyShapp are independent businesses, not our employees, agents or partners. When you give a shop your details through MyShapp, the shop receives them to fulfil what you asked for. Our Terms of Service require shops to use customer details only for that, to protect them, not to market to you without your agreement and not to pass them on.
We can’t see or control what a shop does with information once it has it — for example if it copies your email into its own records, texts the number you gave it, or keeps a delivery address. A shop’s own handling of your information is its responsibility, under the laws that apply to it, and to the fullest extent permitted by law, MyShapp is not responsible or liable for it. If you believe a shop has misused your information, tell us: we may suspend or remove shops that break our terms.
6. How long we keep it
| What | How long |
|---|---|
| Account, shop, saved shops and preferences | Until you delete your account |
| Orders, requests, bookings and reviews | For both sides’ records while the accounts involved exist; when a customer deletes their account, their name and email are removed from orders kept for a shop’s records |
| Messages | With the order, request or booking they belong to |
| Pictures sent in a conversation | Removed about five weeks after the order is finished; the shop is warned a week before |
| Phone notification tokens | Until notifications are turned off, you sign out, or you delete your account |
| Featured-shop counts | 90 days |
| Confirmation and password-reset links | 3 days and 1 hour, single use |
| Backups | Daily copies are kept on our server for 14 days and in our own secure offline storage for up to 30 days; information you delete is gone from all of them once that time has passed |
We may keep limited records longer where the law requires it, for example for tax purposes, or to deal with fraud or a dispute that is under way.
7. Security
We use encrypted connections (HTTPS), hashed passwords and keys, single-use links, secure cookies, rate limits and access checks so that each shop sees only its own orders. Administrative access is restricted to MyShapp’s operator, over an encrypted connection, and every administrative change is logged. No system is perfectly secure, so please use a unique password and keep private order links to yourself: anyone who has one can view that order.
8. Your choices and rights
- See and correct: your account, orders, saved shops and saved address are on your own page; sellers manage everything about their shop in Seller studio. You can also email us for a copy of your information or to correct it.
- Delete: see Deleting your account.
- Sign-in methods: connect or disconnect Google, Apple or Facebook from your account page, or remove MyShapp in that provider’s own settings.
- Location and camera: allow or refuse them in your phone’s settings at any time; MyShapp still works without them.
- Notifications: turn them off in your phone’s settings or in Seller studio → Notifications.
We honor these requests for everyone, wherever you live. Depending on your state — including under Oregon’s consumer privacy law — you may have further rights, and you can appeal a decision we make about your request by replying to our answer. We won’t treat you differently for using your rights.
9. Deleting your account
In the app or on the website: go to You → Account and sign-in, and choose Delete my account at the bottom. It happens straight away and can’t be undone. By email: write to hello@myshapp.com from your account’s address with the subject “Delete my MyShapp account,” and we’ll confirm it’s you and do it within 30 days.
Deleting your account removes your account, sign-in connections, saved shops, saved address, notification tokens, and — if you run one — your shop, its products, photos and the reviews left on it. Reviews and references you wrote about others, your punch cards, trade-room posts and reports you filed are removed. Orders and requests you placed with other shops are kept for those shops’ records with your name, email and any delivery address taken out; messages about those orders stay with the shop’s record of the order. This includes information received through Google, Apple or Facebook sign-in. If you used Facebook sign-in you can also remove MyShapp under Facebook → Settings & privacy → Settings → Apps and websites.
10. Age limit
MyShapp is for people 18 and older. It isn’t directed to children, and we don’t knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.
11. Changes and contact
If we change this policy we’ll update the date at the top, and for significant changes we’ll let sellers know by email or in Seller studio before the change takes effect. Our servers are run by our hosting providers and may be located outside your state or country.
Questions or requests: hello@myshapp.com
Chrono Travel, LLC, doing business as MyShapp · Oregon, USA