Privacy Policy

1 Information We Collect

When you use the JoonWeb Developer Portal, install our AI plugins, or integrate with our APIs, we may process:

• Account & Developer Details: Name, developer email ([email protected]), and partner ID required for API credential issuance.
• Store & Session Identifiers: Store subdomain (e.g., yourstore.myjoonweb.com), HMAC query parameters, and App Bridge authentication tokens.
• AI Generation Queries: Section design prompts and template parameters submitted via AI tools to synthesize .jw template markup.
• Technical Telemetry: HTTP request headers, IP address, user agent, API latency, and error diagnostics to ensure system stability and rate limiting.

2 How We Use Your Information

We use the collected information solely for:

• Validating .jw theme section syntax and {% rules %} JSON schemas.
• Executing programmatic Admin API v26.0 requests (products, collections, inventory) as authorized by your OAuth tokens.
• Returning real-time predictive search suggestions via /suggestions.json.
• Preventing DDoS attacks, abusive scraping, and enforcing developer API rate limits.

3 Data Storage, Security & Encryption

All data exchanged with JoonWeb services is protected with enterprise-grade safeguards:

• Transport Layer Security: All endpoints enforce HTTPS with TLS 1.3 encryption.
• HMAC-SHA256 Signature Verification: Embedded App Bridge requests require valid HMAC signatures matching your App Client Secret.
• Zero Training on Store Data: We do NOT use merchant store contents, products, orders, or private customer records to train LLMs or public AI models.

4 Third-Party Platforms (ChatGPT, Claude, Codex)

When you use JoonWeb skills or plugins inside OpenAI ChatGPT, Anthropic Claude, or Cursor, your prompts are processed under the respective provider's terms and privacy policies. Our Model Context Protocol (MCP) server at https://joonweb.dev/mcp operates strictly as a stateless developer tool for generating template syntax and schema definitions.

5 Your Data Rights & Retention

Under GDPR, CCPA, and international data protection laws, developers and merchants have the right to:

• Request access to stored account and developer telemetry data.
• Request permanent erasure of developer records and revoke application access.
• Export custom theme assets, extensions, and code repositories.