Your device. Your store.

BoothPad is published by CodEven. Service and privacy requests: codeven@codeven.io. The app is undergoing development-store testing and Shopify App Store preparation. Real event-pass charging is disabled; test approvals do not collect money.

Device records and encryption

The catalogue, buyer labels, open draft and saved requests are stored in this browser’s IndexedDB. The current app requires a device passphrase before loading or saving these records. On first setup, existing unencrypted records are atomically replaced by their encrypted equivalent after you choose and repeat a passphrase. Close older BoothPad tabs before setup.

Device records use AES-256-GCM encryption with a random nonce for each save. A non-exportable key is derived locally using PBKDF2-SHA-256, a random salt and 600,000 iterations. The passphrase and derived key are not stored in the database or sent to BoothPad or Shopify. The key stays in the current tab’s memory while unlocked. Reloading or choosing “Lock this tab” requires the passphrase again.

We cannot recover a forgotten passphrase or reset it while preserving locked records. Encryption does not protect records visible in an unlocked tab or a compromised browser. Close other unlocked tabs when leaving the device. Each browser and embedded browser context has separate records; there is no automatic device synchronization.

Downloads and offline use

The service worker caches app files for offline use; it does not cache Shopify API responses. Prepare the standalone pad before an event. Device unlocking works offline when the required app files have been cached. Shopify review, billing verification and draft transfer require an internet connection.

CSV exports and JSON backups are explicit, unencrypted downloads. They can contain buyer labels, notes and saved order details. Keep them in secure storage and delete copies when no longer needed. Device encryption does not encrypt files you previously downloaded. Browser storage eviction, private browsing or device loss can remove the encrypted database; keep backups and your passphrase safe.

Optional Shopify connection

Shopify shows the application permissions when you connect a store. The standalone pad uses an HTTP-only session cookie and a server-held online access token, encrypted with AES-GCM in the hosted database. Sessions expire after at most 12 hours and may end earlier when Shopify authorization expires. Disconnecting deletes that browser session. The embedded admin app uses short-lived Shopify ID tokens and server-side token exchange rather than third-party cookies. Locking local records does not uninstall the Shopify app.

Catalogue preparation retrieves product variant identifiers, names, SKUs, ordinary catalogue prices and total inventory. Native company prices and customer lookup are not enabled. These product details are cached in the encrypted device record after you prepare the catalogue.

Review, draft transfer and billing

An online review sends the saved request details to the BoothPad server to compare with fresh Shopify prices and tracked stock. An explicitly requested transfer sends reviewed quantities, prices, PO reference and note to Shopify. This creates an unpaid draft; it does not send an invoice, collect buyer payment or reserve inventory. Avoid unnecessary personal data in notes. You control any buyer details, tax, shipping, invoicing and final payment in Shopify.

The server stores shop identifiers, expiring review hashes, order UUIDs, payload hashes and Shopify draft identifiers for authorization and duplicate prevention. It does not persist full request bodies, buyer names, customer emails, phone numbers or addresses. Transfer diagnostics record the event without shop, order or draft identifiers. Shopify retains the resulting draft under its own policies.

Before using connected order features, the Shopify store owner accepts the merchant data terms in Shopify Admin. BoothPad stores the shop, version, acceptance date and a pseudonymous signer identifier. Development-store rehearsals are recorded separately from live acceptances. A verified uninstall or shop-deletion webhook removes these records from the live database.

When enabled, event-pass billing stores the Shopify purchase identifier, status, test flag and local expiry. Shopify handles payment information. There are no advertising trackers, customer email campaigns, data sales, profiling or automated eligibility decisions in BoothPad.

Hosting and processors

This application runs on a Hostinger VPS operated by CodEven. Data is transmitted over HTTPS. The BoothPad database is stored on an encrypted volume. Shopify online access tokens are encrypted before they are written to that database. The BoothPad web proxy omits request access logs. Hostinger and Shopify may keep their own operational records. Connected operations send the data described above to Shopify. No device passphrase or local encryption key is transmitted to these services.

Retention and removal

Device records remain under your control until you replace or remove them. “Reset to sample data” replaces records after confirmation. Clearing this site’s browser data removes its encrypted database and offline files; clearing without a backup loses those records. Downloaded files remain wherever you saved them.

Offline-pad connection links expire after 2 minutes, OAuth states after 10 minutes, review approvals after 5 minutes and standalone sessions after at most 12 hours. The running BoothPad service checks for and removes expired authorization records every minute. Order and purchase identifiers remain for duplicate prevention and pass verification until uninstall or a verified shop-deletion webhook. Hostinger server backups have a separate recovery window.

Verified uninstall and Shopify shop-deletion webhooks remove hosted store sessions, reviews, transfer identifiers and purchase records. Mandatory customer-data webhooks are authenticated. The server has no customer-ID-indexed personal records to export or redact. Uninstall cannot erase an offline device or a downloaded backup remotely; the merchant must remove those copies. Contact us with the store domain and request type for hosted-data questions. Do not send passwords, access tokens or payment card details.

See the service terms and support guide. Commercial release follows the remaining acceptance tests and Shopify review.