Privacy Policy

1. Introduction

FYNIT is a product-discovery service that helps consumers discover products from independent merchants and helps merchants connect their Shopify stores to FYNIT. This Privacy Policy explains what information FYNIT handles, why it is used, when it is shared, and the choices available to you.

Please read this policy together with any notices shown when a particular feature is used.

2. Scope

This policy applies to the FYNIT consumer Mobile app and the FYNIT merchant Shopify app and Seller Dashboard.

A merchant's own privacy notice, store policies, and support contacts apply separately to its storefront and transactions. Information entered during Shopify checkout is handled in the merchant's Shopify environment, not through a FYNIT checkout.

The person operating FYNIT and the contact details for privacy requests are identified in section 12, "Who operates FYNIT and how to contact us."

3. Information we collect

Consumer Mobile app

Depending on the features used, FYNIT may collect or handle:

• account and contact information, such as name, email address, optional phone number, country, delivery country, selected shopping city, and gender;

• authentication information, including protected password credentials, authentication methods, email-verification status, the Google subject identifier, verified email address, given name and family name received when Google sign-in is used, and security and session records;

• the Terms version, content digest, and server-side acceptance timestamp recorded when an account is deliberately created;

• shopping preferences, including selected purchase country and city, city-only or wider location mode, seller type, stock, gender, product line, and product Age Group filters;

• saved products, followed stores, alert settings, and in-app notification records;

• product and service interactions, including product impressions, views, checkout handoffs, detected checkout-completion events, the associated product and merchant, time, source, and account-linked city, country, or gender used for service analytics;

• session and profile information, account-scoped filters, recent activity, and limited seen-product identifiers stored locally on the device, plus separate guest shopping preferences when browsing without an account;

• account-deletion verification records, including hashed request and email identifiers, a hashed verification code, workflow status, attempt and failure counts, and related timestamps;

• support communications and information supplied with a request; and

• operational and security information, such as request metadata, a network address used for abuse prevention, timestamps, and redacted diagnostic events.

The selected shopping city is a preference entered or selected by the user. The current Mobile filter does not request GPS or precise device location for this purpose.

Product Age Group describes products a user wants to browse. It is not treated as the user's actual age and adults can use it to shop for children's products.

When Google authentication is chosen, FYNIT receives a signed identity credential, the Google subject identifier, verified email address, and available given and family names needed to authenticate and create the profile. FYNIT does not receive the user's Google password or profile image.

Merchant Shopify app and Seller Dashboard

Depending on the features used, FYNIT may collect or handle:

• Shopify store identity and domain, merchant and support contact details, store profile, locations, delivery coverage, and merchant policy links;

• store verification, onboarding, connection, publication, synchronization, and moderation status;

• product and variant identifiers, titles, descriptions, images, prices, availability, inventory-related status, categorization, publication status, and selected Shopify metadata;

• Shopify installation credentials, session information, webhook-delivery records, synchronization jobs, and other technical integration records;

• store and product analytics from FYNIT consumer interactions and product-view events received through the FYNIT Shopify web pixel; and

• support communications and operational or security logs.

The current Shopify web pixel subscribes to product_viewed events and sends an event identifier, event name and time, Shopify product and variant identifiers, and a public store tracking identifier to FYNIT. Its declared purpose is analytics; marketing, preferences, and sale-of-data uses are disabled in the extension configuration.

4. How we use information

FYNIT uses necessary information to:

• create, authenticate, secure, and support accounts;

• remember shopping preferences and provide product discovery, recommendations, saved products, followed stores, alerts, and notifications;

• connect consumers to merchant product pages and Shopify checkout experiences;

• connect and operate merchant Shopify integrations, synchronize product information, and manage publication to FYNIT;

• provide merchants with service and product analytics;

• respond to support, privacy, deletion, and suspected-misconduct reports;

• detect abuse, protect accounts, troubleshoot failures, and maintain service reliability; and

• comply with applicable law and enforce applicable terms.

FYNIT does not sell personal data. FYNIT does not currently charge consumers or merchants and does not use merchant fees, commissions, paid advertising, or sponsored placement. If monetization or materially different data uses are introduced later, they will be disclosed before they apply and any required agreement or consent will be obtained.

5. When and with whom we share information

FYNIT may share necessary information:

• with hosting, database, email-delivery, authentication, and other service providers that operate FYNIT on its behalf;

• with Google when a user chooses Google authentication;

• with Shopify and the relevant merchant when operating the merchant integration or directing a user to the merchant's storefront or checkout;

• with professional advisers or authorities where reasonably necessary and permitted or required by applicable law; and

• as part of a genuine business reorganization, subject to applicable law and appropriate protection.

Checkout may open in FYNIT's in-app browser, but the transaction occurs in the merchant's Shopify environment. The merchant independently handles information submitted during checkout under its own privacy notice and terms.

The Seller Dashboard presents merchant analytics in aggregated form. Aggregated information is not described as anonymous unless it cannot reasonably be linked back to an individual.

6. Your choices and privacy requests

Where offered, consumers may browse as a guest, change shopping preferences, manage saved products and followed stores, and control alert or notification settings. Google authentication is optional.

Guest preferences are stored separately from account-scoped information. On logout or account switching, the Mobile app clears authenticated session data and the prior account's locally stored filters, recent products, and seen-product identifiers so one account's history is not exposed to another account.

When deletion completes inside the Mobile app, that device clears the same account-scoped data. A deletion started externally cannot remotely erase cached data from another device while it is offline. FYNIT revokes server sessions; when an affected device next connects and the app detects the invalid session, the app clears its authenticated account data. Until that check occurs, cached account data can remain on the device.

Consumers may request help with access, correction, or deletion through the Mobile app, fynit.net/delete-account, or support.fynit@gmail.com. If an in-app or public route is unavailable, or a verified request remains pending, contact the support address.

The Privacy Policy is a notice about data handling. It is not consent to optional marketing or unrelated processing.

7. Account deletion and retention

For a deletion request, FYNIT verifies account ownership proportionately. The process supports password accounts and Google-only accounts without asking a Google-only user for a password they never created. A deletion verification code is valid for two minutes and no more than five incorrect attempts are accepted.

Before verification, FYNIT keeps the deletion request only until its two-minute verification challenge expires. During that active challenge, the record contains protected request and email references, any matched account reference, a protected version of the code, workflow status, attempt count, and timestamps so FYNIT can verify ownership, enforce one-time use and attempt limits, and diagnose a failed confirmation; it does not store the readable code. Separate request rate limits do not require the expired request record to be retained. Expired or invalidated requests become eligible for removal immediately.

After successful verification, FYNIT attempts deletion immediately. If the attempt cannot finish, the verified request does not expire: FYNIT retries it automatically with increasing delays, recovers work interrupted during processing, and continues until it completes or requires operator investigation. The requesting screen reports whether deletion is pending or completed, and FYNIT attempts to send a completion email. A request still pending after 24 hours is marked for operator review. The requester may also contact support.fynit@gmail.com with the deletion request ID for escalation. The 24-hour point is an operational investigation target, not a guaranteed legal or service deadline.

When a verified deletion completes, FYNIT revokes FYNIT sessions and removes the account profile, Terms acceptance metadata, saved products, followed stores, in-app notifications, password-recovery and recent-authentication records, account-linked product history, and identifiable account analytics. FYNIT keeps a minimal completion receipt for up to 90 days so repeated confirmations and status checks return a consistent result. That receipt contains a protected request reference, completed status, and completion and record timestamps; it does not retain the email reference, account identifier, protected verification code, request source, attempt count, or failure details.

Account, profile, shopping-preference, saved-item, followed-store, in-app notification, and Terms acceptance records are kept while needed to provide the account or feature and are removed with account deletion. Signup, password-recovery, and deletion verification codes expire after two minutes; a password-reset authorization expires after ten minutes; Google sign-in challenges and recent-authentication proofs expire after five minutes; and Google replay-prevention records expire with the provider credential. Records may remain briefly after becoming eligible for removal because database cleanup does not run continuously.

Outside account deletion, FYNIT retains identifiable product-interaction and account-linked product-view records while they are needed to provide recent activity, prevent repeated recommendations, measure product discovery, investigate service reliability or abuse, or meet applicable obligations. FYNIT has not activated a fixed 90-day automatic deletion period for these records. Completed account deletion removes the account-linked records directly.

Support correspondence is kept while a request is open and afterward only as needed to document its resolution, handle a follow-up or dispute, protect the service, or meet applicable obligations. Operational and security logs are kept only as needed for reliability, troubleshooting, abuse prevention, security review, or applicable obligations. Backup copies follow the effective provider schedule and are not used as active account data; FYNIT does not state a fixed log or backup period until the relevant production settings have been verified.

Merchant integration records are kept while a store is connected and afterward only as needed to process uninstall or Shopify compliance requests, preserve justified security or dispute records, or meet applicable obligations.

Replacing a name or user identifier is not, by itself, irreversible anonymization. Aggregated counters may be retained only when they no longer identify or reasonably relate to a person.

Deleting a FYNIT account does not delete a Google account or information independently held by a merchant or Shopify for a transaction. Shopify customer-data and shop-redaction requests remain part of Shopify's separate compliance process and safeguards.

8. Where information is processed

FYNIT is operated from Pakistan. Service providers, Shopify, and Google may process information in other countries with different data-protection rules. FYNIT does not claim that personal data remains in Pakistan.

9. Security

FYNIT uses technical and organizational safeguards intended to protect information, including protected authentication credentials, access controls, restricted integration credentials, transport protections, redacted logging, and abuse-prevention controls.

No method of storage or transmission is completely secure, and this policy does not promise absolute security.

10. Children and minimum-age policy

FYNIT's consumer service is intended for adults aged 18 or older. A person under 18 must not create an account or use the consumer service.

Agreeing to the Terms of Service records agreement to the Terms; it is not verified proof of age.

Product categories and product Age Group shopping filters do not determine account eligibility, do not establish a user's actual age, and do not prevent adults from shopping for children's products.

11. Changes to this policy

FYNIT may update this policy when the service, law, or its practices change. The revised document will show its date and version, and additional notice will be provided where required.

12. Who operates FYNIT and how to contact us

FYNIT is operated by Umair Zaeed, a sole proprietor operating as FYNIT in Pakistan.

Correspondence address: Kashmir Road, Sialkot, Pakistan

Privacy and support contact: support.fynit@gmail.com