Data and security

The shape of the system

A shopper opening a page on your store does not talk to us. Your bar's settings are saved into your own Shopify store, delivered inside the page your theme renders, and read from there by a small script. There is no request to our servers on a page view, which means no shopper IP address, user agent or page address ever reaches us — and it also means your bar keeps working if our servers are having a bad day.

Access to your store

The app asks for one Shopify permission: read themes. It uses it to check that your published theme can host the bar, so we can warn you before you spend time building one. It does not read your orders, your products or your customers, because it never asks for permission to.

Adding a permission is a decision we treat as significant. If a future feature needs one, you will be asked to approve it, and we will explain what it is for.

Storefront code

• The storefront script is 4.6 KB compressed and is served by Shopify's own CDN, not by us.
• Bar text is inserted as text, never as markup, so a bar cannot be used to inject code into your storefront.
• There are no third-party scripts, no analytics, no tag managers and no fingerprinting.
• The only thing written to a shopper's device is a “this shopper closed the bar” note in their own browser's local storage, and only if you allow the bar to be closed.

The admin side

• Every request to the app admin is authenticated by Shopify's session tokens.
• Every record we read or write is scoped to the store that asked for it, so one store's data cannot be reached from another.
• Access tokens are stored encrypted at rest and are never written to logs.
• Webhooks from Shopify are verified by signature before anything acts on them, and handled so that a repeated delivery cannot cause a repeated effect.
• Traffic is served over HTTPS only.

Compliance requests

Shopify requires every public app to answer three privacy requests. Ours answer honestly:

• A shopper asks for their data. We have none, so there is nothing to return.
• A shopper asks to be deleted. We hold nothing about them, so there is nothing to delete.
• A store asks to be deleted. Everything belonging to that store is removed.

Reporting a vulnerability

If you believe you have found a security problem, write to [email protected] with enough detail to reproduce it. We will acknowledge within two business days and keep you updated until it is closed. Please give us a reasonable chance to fix it before publishing, and do not access or modify data that is not yours while testing.