Privacy policy
Last updated 2026-08-06
Ranger Downloads is a Shopify app built and operated by Metal Weave Games. It delivers digital files to the customers of the stores that install it. This policy explains what the app stores, why, who else sees it, and how long it lasts.
Merchants who install the app are our customers. Their buyers are not: we handle a small amount of buyer data on the merchant's behalf, as a processor, so a buyer with a question should start with the store they ordered from.
What the app stores
- Order metadata. The Shopify order id, the order number, and the customer email address the order was placed with. This is what lets the app decide who a download belongs to and where to send it.
- Files and file metadata. The files a merchant uploads, along with names, sizes and version history. Files are stored in a private Cloudflare R2 bucket and are only ever served through short-lived signed URLs.
- Download audit events. Each download records a timestamp, the IP address it came from, and the browser user agent string. These exist to enforce download limits and to flag a link being shared from an unusual number of addresses.
- Email send logs. A record of which delivery and update emails were sent, to which address, and whether they were accepted for delivery.
- Store configuration. The merchant's own settings: templates, limits, delivery policies, sending domain, plan.
The app never receives or stores payment details. All payments and all billing for the app itself are handled by Shopify.
Why it is stored
Every item above exists to run the delivery the merchant installed the app to do: match a paid order to files, email the buyer, authorise each click on a link, hold a link to its limits, and tell the merchant what happened. None of it is sold, rented, or used for advertising or profiling, and none of it is used to train anything.
Who else sees it
The app runs on a small set of services, each of which sees only what it needs to:
- Shopify is the source of order and product data and handles authentication, payments and app billing.
- Cloudflare R2 stores the uploaded files. The bucket is private.
- Resend sends the delivery and update emails, and so processes the recipient address and the message body.
- Railway hosts the application and its Postgres database.
How long it is kept
Data is kept for the life of the installation: a download link that has to keep working needs the grant behind it to keep existing.
When a merchant uninstalls, Shopify sends a shop redaction request. The app handles it by deleting that store's files from storage and then deleting the store's records, which cascades to its files, links, grants, download events, flags and email logs.
Shopify's customer redaction request is handled too: the customer's email address is replaced with an irreversible hash and the IP addresses on their download events are stripped, keeping only the counts the merchant's own records depend on. A customer data request is answered by sending the merchant a summary of everything the app holds for that customer, so the merchant can pass it on.
Merchant and customer rights
Merchants can see and change everything the app holds for their store from inside the app, and can remove it entirely by uninstalling.
Buyers should send access and erasure requests to the store they bought from. Shopify's process routes those requests to us automatically, and the app answers them as described above. If you are a buyer and cannot reach the store, write to us and we will help you find the right route.
Security
Download links are signed and checked on every click rather than being trusted once. Files are never public: a valid click is exchanged for a storage URL that expires in about a minute. Access to the production systems is limited to the operator of the app.
Changes
If this policy changes, the date at the top changes with it. This page is the current version, and it is the one the App Store listing points at.
Contact
Questions about this policy, or about data the app holds, go to [email protected].