Last updated 9 July 2026

Privacy

Quadru is a Shopify app that displays your Square Item Library inside the Shopify admin. It reads from Square and Shopify on your behalf. This page describes exactly what it keeps.

What Quadru stores

• Your Shopify shop domain, the offline access token Shopify issues when you install the app, and the scopes granted with it.
• Your Square OAuth access and refresh tokens, encrypted at rest with AES-256-GCM, along with your Square merchant ID and merchant name.
• A cached copy of your Square catalog: items, variations, SKUs, prices, categories, locations, and inventory counts per location. Square remains the source of truth; the cache exists so the item library renders without calling Square on every page load.
• A log of each catalog refresh — when it ran, whether it succeeded, and how many records it touched.
• One setting per shop: whether automatic refreshes are enabled.

What Quadru does not store

• No customer data. Quadru never requests, receives, or retains information about your customers. Shopify’s mandatory customers/redact and customers/data_request webhooks are answered with the fact that there is nothing to erase or return.
• No Shopify product data. Your Shopify products, publications, and markets are read live from Shopify each time you open the page and are never written to Quadru’s database.
• No payment or order data. Quadru requests no scopes for orders, payouts, or payments from either platform.

Access to Square

You connect Square through Square’s own OAuth screen, and you see the permissions before granting them. Quadru requests read-only access to your item library and inventory. It never writes to your Square catalog.

Access to Shopify

Quadru requests read-only access to products, publications, and markets. It never writes to your Shopify catalog.

Deleting your data

Uninstalling Quadru from your Shopify admin deletes everything above. The app revokes its Square token with Square, then removes your session, your settings, the Square connection, the cached catalog, and the refresh logs. Disconnecting Square without uninstalling removes the Square connection and the cached catalog while leaving the app installed. Both are immediate, and neither keeps a backup copy.

You can also write to shop@quadruapp.com to request deletion or ask what is held for your shop.

Who else touches the data

Quadru runs on a single server rented from Vultr, behind Cloudflare, with a PostgreSQL database on the same infrastructure. It sends data to no analytics, advertising, or tracking service, and it sells data to no one. Beyond Shopify and Square themselves, no third party receives your catalog.

Changes

Material changes to this policy will be reflected in the date at the top of this page. Questions go to shop@quadruapp.com.