Privacy policy
PostPath works out which Instagram post produced a sale. This page says exactly what it stores to do that, what it throws away, how long it keeps the rest, and how to have it deleted.
Who this is about
There are two different groups of people in this policy and they are treated very differently.
- Merchants. The shop owner who installs PostPath. We hold their account details and their shop's data.
- Shoppers. The people who tap a merchant's link and sometimes buy something. We deliberately hold as little about them as possible, and nothing that identifies them.
The short version for shoppers. PostPath receives your name, email, billing address and IP address on every order and discards all four immediately. It does not set a tracking cookie and it does not build a profile. One anonymous token is kept in your browser for up to 30 days, described under Cookies below, and nothing PostPath keeps can be traced back to you.
What happens when somebody taps a link
A merchant pastes a PostPath link into a story sticker, a bio, or an automated DM. When somebody taps it, PostPath works out which post it came from, records that, and sends the person on to the merchant's product page. This takes about forty milliseconds and the shopper sees an ordinary link.
To do that, PostPath records the following about the tap:
- Which link was tapped, and which product it points at
- Which post it came from, where that can be worked out
- The browser and operating system, worked out from the user agent string and stored as one short label such as Instagram on iOS. The user agent itself is never stored
- The host of the referring site, for example
l.instagram.com, never the full referring address - The time
It does not record an IP address, a device identifier, a fingerprint, or anything else that would identify a person.
Instagram usernames
Some automated DM tools can pass the recipient's Instagram username along with the link. Where they do, PostPath uses it once, to look up which post that person commented on, and then drops it.
The username is not written onto the token, the click record or the order record. It is never sent to Shopify. The only place a username persists is a short-lived record of who commented on which post, described in the table below, which expires on its own.
What arrives with an order, and what we keep
Shopify sends PostPath a copy of each order. Most of what it contains is discarded before anything is written down.
| Arrives from Shopify | What PostPath does |
|---|---|
| Customer name | Discarded immediately |
| Email address | Discarded immediately |
| Billing and shipping address | Discarded immediately |
| Browser IP address | Discarded immediately |
| Phone number | Discarded immediately |
| Order number and total | Kept |
| Line items and quantities | Kept |
| Discount code used, if any | Kept |
| The PostPath token on the basket | Kept |
The token is a random string. It is not derived from anything about the shopper and cannot be reversed into anything about them. It exists only to connect an order to the post that produced it.
Everything we store, and for how long
| What | Why | Kept for |
|---|---|---|
| Merchant account | Platform, account id, access token, expiry dates, permissions granted, date connected | Until disconnected or deleted |
| Link records | The link, the product, the post, the route it belongs to | Until the merchant deletes it |
| Tokens | Connects a tap to an order | 90 days |
| Tap records | Browser type, referring host, surface, time | 1 year, and the newest 5,000 per shop |
| Order records | Order number, totals, line items, the post it is attributed to | Until the merchant deletes their data |
| Comment records | Which Instagram username commented on which post, so a DM reply can be matched | 45 days |
| Recent commenter queue | Usernames who commented in the last quarter of an hour | Pruned each sync, expires within 1 day |
| Claim records | Marks a commenter as already matched, so they cannot be counted twice | 6 hours |
| Post and story data | Captions, view counts, timestamps, pulled from Instagram | Until disconnected or deleted |
| The token in the shopper's browser | Held on the device by the shop's theme, so a tap that leads to a purchase days later is still counted. Carries no identity of any kind | 30 days, on the device rather than with us |
Everything is stored in a Redis database hosted by Upstash in the European Union, and the service runs on Vercel. Both are used as processors and neither is given access for their own purposes.
What PostPath cannot do, and why
A tap cannot be traced to a person. Tap records hold no name, no email, no IP address and no identifier of any kind. That is a deliberate design choice and it is what makes the system safe to run. It has one consequence worth stating plainly: if somebody asks us to delete their data, we cannot find their taps, because there is nothing in a tap record that would let us recognise them.
For that data, expiry is the deletion mechanism. Tap records are capped at the newest 5,000 per shop and expire after a year, whether anybody asks or not.
Orders are different. An order carries an order number, so a merchant or a shopper who supplies that number can have the corresponding record deleted.
Deleting your data
If you are a merchant
Disconnecting Instagram inside PostPath stops all data collection immediately. To have everything erased, email dan@postpath.link and it will be done within 30 days. That covers your account, your links, your posts, your orders and every comment record associated with your account.
If you are a shopper
Ask the shop you bought from. They can pass the request on, or email dan@postpath.link with the order number. The order record will be deleted. As explained above, taps cannot be located from a person's details and expire on their own.
If you are removing PostPath from Instagram
Removing the app in your Facebook settings triggers an automatic notification to PostPath. Your access token is destroyed at once and data collection stops. If you use Facebook's data deletion request, PostPath deletes every record tied to that account and returns a confirmation code you can use to check the status.
Access keys
A merchant can issue keys from their PostPath dashboard. There are two kinds and each one names a single shop, so a key issued for one shop cannot be pointed at another:
- Read only keys. Open one shop's dashboard and change nothing. They exist so an app reviewer can be shown a working dashboard without being handed an account that can alter anything. They expire, 90 days by default.
- Mint keys. Let a direct-message tool ask PostPath for a ready link when it sends a message. They resolve links for that one shop and can do nothing else.
A key holds the shop it belongs to, when it was made and when it expires. It holds no personal information about anyone. A merchant can revoke any key at any time, and every key naming a shop is revoked automatically when that shop uninstalls the app or asks for its data to be deleted, so a key can never outlive the shop it was issued for.
The signed-in session behind the dashboard works the same way: it names one shop, it expires within 12 hours, and it is revoked with everything else.
Rate limiting
To stop one person guessing passwords or hammering the redirect, PostPath counts recent requests per caller. It does not store your IP address to do that. The address is turned into a salted one-way digest the moment it arrives, the digest is what is counted, and the address itself is never written anywhere.
Two counters exist. Failed sign-in attempts are kept for 15 minutes. Redirect requests are kept for 60 seconds. Both hold a digest and a number, nothing else, and both delete themselves when the time is up. A digest cannot be turned back into an address, and it is not used for anything except comparing a caller to themselves.
Cookies, and the one thing kept in your browser
PostPath sets no cookies on shoppers, uses no tracking pixels, no fingerprinting and no third party analytics. It does keep one thing on the device, and this section says exactly what it is.
When somebody taps a PostPath link they arrive at the shop with a token on the address, something like
?ovr=k7m2ptq. The shop's theme stores that token in the browser's local storage under the
name ovr_token and keeps it for up to 30 days. That is what allows
somebody who taps a link today and buys next week to still be counted against the post that sent them.
Without it the connection would survive only until the page was closed.
What is stored is the token, the time it was stored, and whether it has been written onto the basket yet. That is the whole of it. The token carries no identity. It is a short random string of letters and digits. It holds no name, no email address, no Instagram username, no IP address and nothing about the device, and there is nothing in it or attached to it that describes the person carrying it. A newer tap replaces it rather than adding to it, so only one is ever held.
It is stored by the merchant's own shop, so no other website can read it, and it is never sent anywhere except to that shop. After 30 days it is ignored and deleted. Clearing site data for the shop removes it at once.
The token is written onto the shopping basket as an attribute, which is how it reaches the order. So that a change to the basket does not lose it, the script watches for the basket being added to, changed or emptied and writes the token again afterwards. It records nothing about what was in the basket, and sends nothing to PostPath.
Two further things about how it works, stated because they are true rather than because they collect anything. The script runs on every page of the shop, not only product pages, because a basket can be changed anywhere. And it replaces the browser's network function for the life of each page, so that it can tell when the basket has been added to or emptied and write the token back afterwards. It reads only the address of each request, to recognise a basket one. It does not read, record, or send anywhere the contents of any request the page makes.
This runs as an app embed in the merchant's theme, which the merchant turns on. Where a merchant has not turned it on, none of the above happens and their orders are simply not attributed.
Who else sees this data
Nobody, other than the processors needed to run the service.
- Upstash, database hosting, in the European Union
- Vercel, application hosting
- Meta, which supplies post and comment data through the Instagram Graph API when a merchant connects their account
- Shopify, which sends order notifications for the merchant's own shop
Data is not sold, not shared with advertisers, not used to train anything, and not combined across merchants. One merchant can never see another merchant's data.
Your rights
Under the UK GDPR you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, object to processing, or complain to the Information Commissioner's Office. Email dan@postpath.link and you will get an answer within 30 days.
The lawful basis for processing merchant data is performance of a contract. The lawful basis for the minimal, non-identifying tap data is legitimate interest in measuring which content produced a sale, balanced against the fact that it identifies nobody.
Children
PostPath is a tool for shop owners and is not directed at anybody under 18. It does not knowingly collect anything about children.
Changes
If this policy changes in substance, the date at the top changes and any connected merchant is emailed. Older versions are available on request.
Contact
Email: dan@postpath.link
PostPath, 2026. postpath.link