Privacy policy
Effective October 6, 2026
The short version. Your Olympus runs in your own Railway account, and your store's data stays there. We can't see it. This site, oldbones.ai, keeps only what it needs to set your Olympus up, help you sign in to it and connect it to your store: your email, your store's name and your Olympus's address. We don't sell data, show ads, use tracking cookies or train AI on anything.
Who we are
Olympus by Old Bones is made by Old Bones Therapy, Inc., a California corporation ("we", "us"). This policy covers oldbones.ai, the services it runs for your Olympus, and the Olympus by Old Bones app for Shopify. Questions go to support@oldbones.ai.
Where your data lives
When you sign up, oldbones.ai builds your own copy of Olympus in your Railway account. Everything Olympus collects from your store and your marketing tools is kept on that copy, on storage in your Railway project, under your control. We have no access to your Railway account after setup, and no copy of your store's data. Railway is your provider for that copy; its privacy policy applies to it.
Olympus's AI features run in your own AI account (for example your Claude plan, or an API key you add). Your Olympus sends your questions and the data needed to answer them to that provider directly, never through us.
What oldbones.ai collects
| What | Why |
|---|---|
| Your email and your store's name, when you sign up | To confirm the email is yours, build your Olympus, send you sign-in links, and tell you about your account |
| A 6-digit confirmation code | To confirm your email. We keep only a scrambled (hashed) copy, for 10 minutes |
| Access to the Railway workspace you choose | To create your Olympus there. We use it only while the build runs and discard it when the build ends. We keep the workspace's name and the project we created |
| Your Olympus's addresses, its store name and owner email, its software version, the Shopify store address it's connected to, and a key it shares with us | To find your Olympus when you sign in at oldbones.ai, check that it is still running, pass it Shopify's notices and renewals, and confirm that requests between it and oldbones.ai are genuine |
| A record of each signup step (when, which step, and any error) | To fix signups that fail |
| Server logs (addresses and errors) | To keep the site running and secure |
Every few hours oldbones.ai checks that each Olympus still answers (its health page, which reports only that it is running and its version). When your Olympus starts, it tells oldbones.ai its store name, owner email and version, so sign-in keeps working if they change. Nothing else in your Olympus reports to us.
Sign-in emails. When you ask for a sign-in link, oldbones.ai asks your Olympus to make one, and your Olympus sends it back through oldbones.ai to be emailed to you. The link passes through; we don't store it.
Cookies. While the site is in preview, entering its password sets one cookie that remembers you entered it. There are no analytics, advertising or tracking cookies.
Fonts. Our pages load fonts from Google Fonts, so your browser contacts Google when it shows them.
When you connect Shopify
The Olympus by Old Bones app for Shopify connects your Shopify store to your Olympus. It asks for read-only access to orders, customers, products, inventory, locations, discounts and reports.
- The connection. When you approve the app, Shopify sends oldbones.ai a one-time authorization, which oldbones.ai exchanges for access tokens and hands straight to your Olympus. Shopify's tokens expire within an hour, so your Olympus asks oldbones.ai to renew them while it collects; oldbones.ai renews them and hands them back. We never store your Shopify tokens or any Shopify data.
- What your Olympus keeps. Your Olympus reads your orders to work out daily totals: sales, orders, refunds, discounts, product and variant sales, costs, stock, and how many customers were new or returning, by month first ordered. It keeps only those totals. It reads a customer's ID only to tell new customers from returning ones, and does not write it down. It never reads or keeps your customers' names, email addresses, phone numbers or addresses. Shopify requires an app that uses its sales reports to hold access to those fields, so our app has that access, but Olympus's report queries return totals only.
- Shopify's notices. Shopify sends app notices to oldbones.ai: that the app was uninstalled, and your customers' privacy requests. oldbones.ai passes each one to your Olympus, which acts on it, and keeps only a record that it arrived (your shop's address, the type of notice and when).
How we use it
Only to provide the services above: building and updating your Olympus, sign-in, connecting Shopify, support, and keeping oldbones.ai secure. We don't sell or rent personal data, share it for advertising, or use it to train AI.
Who we share it with
We use a few providers to run oldbones.ai. Each handles only what its job needs:
| Provider | What it does for us |
|---|---|
| Railway | Hosts oldbones.ai and its records |
| Resend | Sends our emails (confirmation codes and sign-in links) |
| Cloudflare | Runs our domain's DNS, including your Olympus's address |
| Shopify | The platform our Shopify app connects to |
We may also disclose information if the law requires it, or to protect our users or our rights. If Olympus is ever sold or merged, this policy will continue to apply to the data we hold.
How long we keep data
On oldbones.ai
- Confirmation codes: 10 minutes, and only as a scrambled copy.
- Signups in progress and build progress: forgotten an hour after they start or finish. What a signup leaves behind is the signup record below.
- Railway access: only while your Olympus is being built; discarded when the build ends, whether it succeeds or not.
- Shopify tokens: never stored. Held only for the moment it takes to pass them to your Olympus.
- Signup records: 12 months.
- Records of Shopify's notices (your shop's address, the type of notice and when; no customer details): 12 months.
- Your Olympus's directory entry (store name, addresses, owner email, version, connected Shopify store address and shared key): while your Olympus exists. When we detect it has been deleted, we remove its owner email, key and Shopify store address within 90 days. We keep the address name, so it is never given to a different store.
- Server logs: as long as our hosting provider keeps them, typically a few weeks.
Shopify data in your Olympus
- Order-level data (orders, line items, customer IDs) is held in memory only while your Olympus collects, and is never written to storage.
- Daily totals are kept for as long as your Olympus is connected to Shopify, because a store's history is what Olympus analyzes. You can delete them at any time by deleting your Olympus in Railway.
- If you uninstall the app, your Olympus stops collecting from Shopify. When Shopify asks for your shop's data to be removed (48 hours after uninstalling), your Olympus deletes everything it collected from Shopify. Data from your other connections stays until you delete it.
- Your customers' privacy requests from Shopify are answered from what your Olympus holds, which contains nothing that identifies them.
Security
oldbones.ai is served only over HTTPS. Confirmation codes are stored scrambled, every request between oldbones.ai and your Olympus is signed with a key only the two share, and we don't keep tokens for your Railway or Shopify accounts. Our hosting provider encrypts stored data at rest. Your Olympus runs in your Railway project, where its data is encrypted at rest by Railway.
Your choices and rights
You can ask us to show you, correct or delete the personal data oldbones.ai holds about you by emailing support@oldbones.ai. We'll answer within 30 days. Deleting your Olympus is in your hands: delete its project in Railway and uninstall the Shopify app.
Depending on where you live (for example California, or the European Economic Area and the UK), you may have further rights, such as to object to or restrict how we use your data, or to complain to a data protection authority. We process account data because we need it to provide the service you signed up for, and to keep the service secure. We don't sell personal information or share it for cross-context behavioral advertising.
oldbones.ai is run from the United States, so data it holds is processed there.
Children
Olympus is for businesses and is not meant for anyone under 18.
Changes
If we change this policy, we'll update the date above. If a change matters, we'll email you before it takes effect.