Privacy policy
Blog Writer, by Marz Agency LLC. Last updated 2 September 2026.
The short version. Blog Writer stores your store’s domain, an access token so it can publish for you, and the API keys you create. It never receives anything about your customers, and it never stores the text of your articles. Those live in Shopify, on your store.
Who this is
Blog Writer is built and operated by Marz Agency LLC. For anything in this policy, write to hovsep@marzagency.com.
What the app stores
All of it, in full:
| What | Why it exists |
|---|---|
Your .myshopify.com domain | To know which store a request belongs to. |
| A Shopify access token | Granted by Shopify at install and scoped to write_content. It is what lets the app read and write blog posts on your store, and nothing else. |
| An install identifier | Regenerated every time the app is installed, so keys issued to an earlier install stop working. |
| The API keys you create | The label you gave it, the last four characters, and a keyed hash. The key itself is never stored and cannot be read back, which is why it is shown only once. |
| Identifiers of posts made through the API | The Shopify id of any article published through an API key, so a key can edit what it created and nothing else on your blog. No article text is kept. |
| Request counters | A number per store and per key, to cap how often the app can be called. No IP addresses are recorded. |
What the app never receives
- Anything about your customers. No names, emails, addresses or order data.
- Payment or card details. There is nothing to pay for.
- Your Shopify password. The app never sees it, and neither does any tool you connect.
The app asks for one permission, write_content, which covers blogs and articles. Permission to upload files is separate and optional: Shopify asks for it only if you press Allow image uploads on the app’s Connect page.
Where text goes when you write a post
When you press Write it, the topic you typed is sent to Anthropic’s Claude API, which returns the article. When you ask for a rewrite, the existing post and your instruction are sent the same way. Under Anthropic’s commercial terms that text is not used to train their models.
Nothing else about your store goes with it, and a draft only reaches your storefront when you press publish.
Who else is involved
- Shopify, where your blog posts actually live, and the source of the access token.
- Anthropic, which writes and rewrites the articles, as described above.
- Vercel, which hosts the app.
- A hosted Postgres database, which holds the short list in the table above.
Nothing is sold, rented or shared with anyone else, for any purpose.
Cookies and tracking
There are none. The app has no analytics, no advertising pixels, and sets no cookies of its own. Inside the Shopify admin it authenticates with a short-lived session token that Shopify issues for each request.
How long anything is kept
- When you uninstall, the access token is deleted immediately and every API key you created is revoked. Any tool still holding a key stops working at that moment.
- Forty-eight hours after an uninstall, Shopify asks the app to erase the store, and everything in the table above is deleted outright.
- Your blog posts stay put. Uninstalling does not remove or change anything already published on your store.
Shopify also forwards requests about customer data on a merchant’s behalf. The app holds none, so there is nothing to hand back and nothing to erase.
Asking for your data, or its deletion
Uninstalling triggers the deletion above on its own. If you would rather ask directly, or want a copy of what is held, email hovsep@marzagency.com from an address associated with the store and it will be handled within 30 days.
Security
Traffic is encrypted in transit. Access tokens and key hashes sit in a private database that is not reachable from the public internet. API keys are stored only as a keyed hash, computed with a secret held outside the database, so a copy of the database on its own cannot be turned back into working keys.
Children
Blog Writer is a tool for businesses. It is not directed at children and collects nothing from them.
Changes
If what the app stores ever changes, this page changes with it and the date at the top moves.