Last updated: 16 July 2026

Bones — Blog Composer (“Bones”, “the extension”) is a Chrome extension that adds a visual composer to the Shopify blog post editor. This policy explains
what data the extension handles and what it doesn’t.

The short version: your writing stays in your browser. Bones has no analytics, no tracking, and no interest in your content. The extension makes exactly two
kinds of network request, both described below, and neither one carries your article.

WHAT BONES DOES WITH YOUR CONTENT

Everything you compose in Bones happens locally, inside your browser, on the Shopify admin page you already have open:

  • The extension reads the existing article content from the Shopify editor on the page, and writes your composed content back into that same editor. It does this in the page itself, the same way you would by typing.
  • While you compose, your draft exists only in your browser. It is not transmitted, stored, or copied anywhere by the extension.
  • Bones does not use the Shopify API. It has no access to your store’s products, orders, customers, themes, settings, or anything beyond the editor content on the blog post page you are viewing.
  • Your article content is never sent anywhere by the extension. Not to us, not to anyone.

WHAT BONES SENDS OVER THE INTERNET

Two things, and only these two.

  1. Licence verification.

When you activate a licence key, and periodically afterwards to confirm it is still valid, the extension sends two pieces of information to our licensing system at storemastery.com:

  • your licence key, and
  • a device identifier — a random string the extension generates the first time it runs and keeps in your browser’s local storage. It is not derived from your computer, your browser, or you; it is a random value with no meaning outside our licence records. It exists so that one licence can be limited to three browsers. It does not identify you personally, and we do not use it to track you.

As with any web request, our server also sees your IP address. We use it only to rate-limit the licence endpoint so keys cannot be guessed by brute force. It is hashed into a short-lived counter and is not stored and not logged against your licence.

This request does not include your article content, your store data, or your browsing activity.

  1. Product lookup — only when you ask for it.

If you add a Product Card block and paste a product URL, the extension fetches that product’s public information (its title and image) directly from the storefront address you pasted, so it can build the card. This request goes to that store — usually your own — and not to us. We never see it. It happens only when you paste a product URL, and never otherwise.

Beyond those two, Bones does not:

  • collect analytics or usage statistics
  • log errors to a remote service
  • track which sites you visit
  • send your content anywhere
  • use cookies
  • load remote code or advertising
  • phone home on a schedule for any purpose other than the licence check described above

One thing worth being precise about: when a product image or a video embed appears in the composer, your browser loads that file from wherever it is hosted — the Shopify CDN, or a video host such as YouTube — exactly as it would on any ordinary web page, and subject to that host’s own policies. The extension does not send those hosts anything about you beyond the ordinary request your browser makes for the file itself.

WHAT BONES KEEPS IN YOUR BROWSER

The extension stores three small values in your browser’s local storage, on the Shopify admin domain. They stay there when you close the tab, and they never leave your browser except as described above:

  • Your licence key and its last known status — so you don’t have to re-enter it, and so the extension works without asking our server every time. The date the extension first ran — to run the 7-day free trial.
  • The random device identifier — to count browsers against your licence’s three-browser limit.

Your article drafts are not among them. Clearing your browser data removes all three. Clearing them costs you nothing except re-entering your key — though note that a cleared device identifier is treated as a new browser, and takes up a seat until the old one expires after 30 days.

PURCHASES

Purchases are handled by Paddle (paddle.com), our merchant of record, on their checkout pages — not inside the extension. When you buy Bones, Paddle collects
the information needed to process the payment (such as your name, email address, and payment details) under its own privacy policy: https://www.paddle.com/legal/privacy

When your purchase completes, a customer account is created for you on storemastery.com using the email address from your purchase, and your licence key is attached to it — so you can log in and retrieve your key at any time.

The extension itself never sees or handles your payment details.

DATA WE STORE

We (the developer) hold:

  • the customer record created when you purchase — your email address, your licence key, and your customer account on storemastery.com;
  • the device identifiers seated against your licence, with the dates first and last seen, so the three-browser limit can be counted;
  • the payment records Paddle holds as merchant of record, under its own policy.

We use this to verify licences, let you recover a lost key, enforce the browser limit, and provide support. We do not sell or share this information. We only send marketing email if you opted in at checkout, and you can unsubscribe at any time.

Retention. A device identifier is deleted automatically once it has gone 30 days unseen. Cancelled or revoked licence records are deleted automatically after 13 months of inactivity. You can ask us to delete your customer record and licence at any time — see below.

PERMISSIONS

Bones requests no browser permissions at all. It runs only on Shopify blog post admin pages (admin.shopify.com/store//content/articles/) and has no access to
any other website, tab, or browsing data. It cannot read other sites you visit, because it is never loaded on them.

YOUR RIGHTS

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email bones@storemastery.com and we will action it. Deleting your
licence record means the licence stops working, so we’ll confirm before doing it.

CHILDREN

Bones is a business tool for Shopify store administrators and is not directed at children.

CHANGES TO THIS POLICY

If the extension’s behaviour changes in a way that affects this policy, we will update this page and the “Last updated” date before the change ships.

WHO WE ARE

Bones — Blog Composer is developed by Daniel Barrett trading as Storemastery

Questions about this policy, or any request about your data:bones@storemastery.com