Privacy Policy

Effective 12 October 2026, updated 15 October 2026 (Google user data and sharing sections) and 17 October 2026 (how we protect your data). Watermelon is operated from Toronto, Canada. Questions: [email protected]

Watermelon is a chief-of-staff service for online stores. A store owner connects the systems their business runs on and Watermelon reads them to produce a daily brief, department views, to-dos and answers to questions. This policy explains what we collect, why, and how we handle it.

What we collect

Account data: your name, work email and a password hash, plus the company name and store domain you give us.
Connected-system data: when you connect a platform (for example Shopify, Meta Ads, Google Analytics, Klaviyo, QuickBooks, a help desk), we read the business data that platform makes available under the read-only permissions you approve: orders, products, inventory, customers, fulfilments, advertising performance, email performance, accounting reports and support tickets. We store access tokens encrypted and the summaries we compute from the data.
Usage data: questions you ask, objectives you set, and standard server logs.

How we use it

To compute the checks, briefs, department views and answers shown to you and the people you invite to your workspace.
To keep connections working (token refresh) and to run the daily pull on your behalf.
To support you and to improve the product in aggregate, never by selling or sharing your store's data.

Where it lives and who sees it

Data is stored on Cloudflare infrastructure in encrypted form and is kept in a workspace that belongs to your company. It is never mixed with another company's data. Only members of your workspace and Watermelon staff supporting your account can see it. We use a language-model provider to answer questions; the model receives the summary needed to answer and does not train on it.

How we protect your data

Sensitive data (your sign-in details, the access tokens for the systems you connect, and the business figures we read from them, including Google user data) is protected by the following mechanisms:

Encryption in transit. Watermelon is served only over HTTPS (TLS 1.2 or newer), and every call we make to Google, Shopify and the other platforms uses TLS as well.
Encryption at rest. Access and refresh tokens are encrypted with AES-256-GCM before they are written to the database. The encryption key is held only as a secret on our hosting platform, never in the database, in source code, in chat or in documents. The database itself is stored encrypted by Cloudflare.
Passwords and sign-in links. Passwords are stored as salted PBKDF2-SHA256 hashes (100,000 iterations), never in clear text. One-time sign-in links expire after 15 minutes and password reset links after 60 minutes, and each works once.
Access control. Each company's data lives in its own workspace and is never mixed with another company's. A person sees only the workspaces they belong to, and workspace owners decide which pages each team member can open. Production systems (hosting account, database, deploy keys, platform developer accounts) are reachable by two named operators only, each with multi-factor authentication. Staff look at customer data only to support you at your request, to investigate a security problem, or when the law requires it.
Least privilege. We ask every platform for read-only permissions, limited to the property, site or store you choose, and we never write back to your accounts.
Session and request security. Sign-in cookies are HttpOnly, Secure and SameSite. OAuth flows use short-lived, single-use state values to prevent request forgery. Inbound webhooks are verified with HMAC signatures, database queries are parameterised, and Cloudflare's web application firewall and bot management sit in front of the application.
Monitoring and incident response. Application and access logs are kept for 30 days and alert us to failed sign-ins, unusual error rates and unexpected token use. If a security incident involves your data, we notify you and the platform concerned without undue delay and within 72 hours of confirming it, with the facts, the impact and what we did about it.
Deletion and backups. Disconnecting a system deletes its tokens immediately. Deleting a workspace removes all of its data within 30 days, and backups expire within 30 days after that. Backups are encrypted and used only for recovery.

Our full information security policy is available on request from [email protected].

Who we share data with

We share connected-system data, including Google user data, with no one except two service providers that process it on our instructions and under contract:

Cloudflare, Inc. hosts the application and stores the data, encrypted, in your workspace.
OpenAI receives the computed summary needed to answer a question you ask Jordan, returns the answer, and does not train on it.

We do not sell your data, do not share it with advertisers, data brokers or other customers, do not use it to serve advertising, and do not transfer it to any other party, except where the law requires it. Watermelon staff read it only to support you at your request, to investigate security problems, or to comply with the law.

Google user data

When you connect Google, Watermelon asks for two read-only permissions and nothing else:

Google Analytics (analytics.readonly): we read report data for the one Analytics property you choose: sessions, users, add-to-cart, checkout and purchase counts, purchase revenue and traffic by channel for the last 60 days. This feeds the Web view, the conversion card, the funnel and traffic-mix checks and your daily brief.
Search Console (webmasters.readonly): we read the top search queries for the one site you choose, with clicks, impressions, click-through rate and position for the last 30 days. This feeds the Search view and the search-visibility check.

We use Google user data only to show you these views, checks and briefs and to answer the questions you ask about them. We do not read, change or delete anything else in your Google account, and we never use Google user data for advertising, to build profiles, or to train models. It is shared only with the two service providers named above, and is never sold or transferred to anyone else.

Your Google access token is stored encrypted and is deleted the moment you disconnect Google on the Connections page or revoke Watermelon at myaccount.google.com/permissions. The summaries we computed from Google data are deleted with your workspace, within 30 days of your request, and leave backups within 30 days after that.

Google user data is protected by every measure in How we protect your data: encryption in transit and at rest, access controls, least-privilege read-only scopes, monitoring, incident notification and deletion on disconnect.

Watermelon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Platform-specific terms

For Shopify, Meta, Google and Intuit connections we comply with each platform's developer and data policies. We request read-only scopes only. You can revoke any connection from the Connections page or from the platform's own settings at any time.

Retention and deletion

You can disconnect a system at any time; its tokens are deleted immediately. You can ask us to delete your workspace and all data in it by writing to [email protected], and we do so within 30 days. Backups expire within 30 days after that.

Cookies

We use one session cookie to keep you signed in and no advertising cookies.

Changes

If this policy changes materially we tell workspace owners by email before the change takes effect.