Privacy policy

Updated 31 October 2026

ForthMatch is a free Shopify app for tracking how a store's 3PLs perform. This policy covers the app at app.forthmatch.io, including the public 3PL directory and guides on this site. The marketing site at forthmatch.io has its own policy.

ForthMatch is run by Forthcast. You can reach us at info@forthmatch.io.

What we get from Shopify

When you install the app, Shopify gives us your shop domain, an access token and the permissions you approved. We read orders and fulfilments, locations, shipping and market settings, products, and customer data where a feature needs it.

For the performance numbers we use things like order IDs and names, created and cancelled times, test-order flags, order values, fulfilment status and times, tracking details, warehouse or location names, and destination country and region. One analytics view reads customer email and rough address fields to build store-level views. We keep a cached summary of results per shop and date range, not a copy of your raw orders.

What you give us

In the app you may enter SLA targets, report settings and recipients, 3PL contacts, team member details, support messages, and API key names and permissions. API key secrets are stored as hashes. If you turn on browser push, we store the push endpoint and keys your browser gives us.

On the public directory you may suggest a 3PL or claim a 3PL profile. For a suggestion we store what you type in the form, including your email if you give it. For a claim we store the work email you use and send a confirmation link to it. We use these only to review the suggestion or claim and to contact you about it.

Usage and reliability data

The app keeps a first-party visit log. It stores a hash made from your IP address, browser user agent and a salt that changes every day, plus the page path, method, status, duration, referrer site, a shortened user agent and a country code if our host provides one. We don't store the raw IP address in that log. The daily hash still counts as pseudonymous personal data, so we treat it as personal data. We use it to keep the service working and to see where it breaks.

Support chat

The app has a support chat run by Crisp. If you use it, Crisp gets your messages and the usual browser details such as IP address and browser type.

How we use it

We use Shopify data to work out 3PL performance, like dispatch times, processing time and SLA results. We show this in the app, build reports, and send the alert and report emails you switch on. Scheduled reports go to the addresses you enter. SLA alerts can go to your 3PL contact and the people you copy in. Weekly summaries go to your store's contact address.

Weekly summaries are written from a fixed template with your store's numbers. No AI service sees your data.

The public directory can show performance numbers for a 3PL only once enough stores track that 3PL, and only as combined figures. No single store's numbers are shown or can be picked out.

We don't sell personal data.

Who handles data for us

• Shopify, to connect to your store.
• Render, which hosts the app, in Frankfurt, Germany.
• Neon, our database, on AWS in Frankfurt (eu-central-1).
• Resend, which sends our email from forthmatch.io, using its EU region.
• Crisp, for support chat, based in France.

Browser push messages go through your browser's own push service. Some of these companies may handle data outside the EU under their own terms and safeguards.

Cookies

The app uses cookies for sign-in and sessions. Crisp stores its own cookie or browser storage so a chat survives a page reload. We don't use analytics or ad cookies, and the visit log doesn't set a cookie.

How long we keep it

We keep shop settings and records while they're needed to run the app. When you uninstall, we stop using your Shopify access token straight away. Your shop's data isn't deleted at that exact moment. Shopify sends us a shop/redact request after uninstall, and that deletes your shop and its related data, including the cached results, scheduled reports, queued emails and shop-linked visit records.

We also handle Shopify's customer data request and customer redact webhooks. If you need something specific deleted or exported, email us and we'll do it by hand.

Visit log rows are deleted after 90 days. Directory suggestions and claims are kept while the listing exists, or until you ask us to delete them. Some records may be kept longer if the law requires it or there's an open dispute.

Your rights

You can change report recipients, notifications, team access and API keys in the app, and you can uninstall it from Shopify at any time. You can ask us to access, correct, export or delete your personal data, or to stop or limit using it where the law gives you that right. Email info@forthmatch.io. We may need to check you are the right person or store owner first.

The visit log is built so we can't easily tie rows to one person. If you ask about it, tell us the date, rough time and what you were looking at, and we'll see what we can find.

If you're in the EU or UK you can also complain to your local data protection authority.

Security

We limit who can get into the systems that run ForthMatch and use encrypted connections. No online service is perfectly secure. If you think something's gone wrong, email info@forthmatch.io.

Changes

When this policy changes we update the date at the top. If a change affects how we use your data in a big way, we'll tell you in the app or by email.