VaferVafer is a cookie consent product. It would be absurd for us to be careless with data, so this policy is short, specific, and written to be read. Last updated: 21 September 2026.
Who we are
Vafer ("we") operates the vafer.app website and the Vafer app for Shopify. Contact for anything in this policy: hello@vafer.app.
This website (vafer.app)
We run no analytics and no advertising trackers on this site. If you join the waitlist we store: your email address, when you joined, which form you used, and the country your request came from. We use that to send you early-access emails about Vafer and nothing else; we never sell or share it. Reply "remove" to any email, or write to us, and we delete it.
The Vafer app — data about merchants
When a store installs Vafer we store the shop's domain and the settings the merchant creates: consent rules, banner design, cookie declaration, retention preferences. We do not read customers, orders, or products — the app requests no such permissions.
The Vafer app — data about shoppers
Vafer records consent decisions on the merchant's behalf, acting as their processor. One record contains: a one-way hash (a salted SHA-256 fingerprint that cannot be reversed into an identity), the country/region, the categories chosen, the policy version, the method (banner or an automatic Global Privacy Control signal), and the time.
A consent record contains no name, no email, no raw IP address, and no user agent. Records are deleted automatically after the retention period the merchant sets (default: 365 days), and are deleted when a merchant uninstalls and requests erasure through Shopify's mandatory redaction process, which we implement.
Where data lives, and who processes it
| Provider | Role | Location |
|---|---|---|
| Cloudflare | Edge delivery of consent rules, waitlist storage | Global network |
| Neon | Database for consent records and settings | United States |
| Railway | Application hosting | United States |
| Shopify | The platform the app runs on | Per Shopify's policies |
| Resend | Sending waitlist emails | United States |
Consent records, including those of EU visitors, are stored in the United States. If your compliance posture requires EU data residency or specific transfer mechanisms, contact us before relying on Vafer — we would rather tell you the truth than win the install.
Your rights
Ask us what we hold about you, ask us to correct it, or ask us to delete it: hello@vafer.app. For consent records processed on a merchant's behalf, direct the request to the merchant (the data controller) — we act on their instruction, and we support the erasure flows Shopify requires of every app.
Changes
If this policy changes materially, the date above changes with it, and waitlist members get an email before, not after, anything new applies to them.