Security & data handling

Last updated September 16, 2026

A plain-language summary of how the app protects store data. Report a vulnerability: redroseads1@gmail.com.

Least-privilege, read-only access

Scopes requested: read products, read inventory, read locations, read orders. The app cannot create, edit or delete anything in your store.
The app's order queries ask Shopify only for line items, quantities, dates, refunds and cancellation status, never customer names, emails or addresses. Order webhooks from Shopify arrive with the full order, including customer details; the app reads the same few fields and does not store the rest.
Shopify treats order data as protected customer data even without personal details, so the app goes through Shopify's protected customer data review before installing on live stores.
Your store email and shop name are stored so reorder digests and account emails can reach you.

The app runs embedded in Shopify admin and authenticates every request with Shopify-signed session tokens (verified signature, audience, expiry and shop).
Offline access tokens are expiring tokens obtained through Shopify token exchange, refreshed automatically, and encrypted at rest with AES-256-GCM.
Every database query for store data is scoped to the authenticated store. Automated tests check that one store cannot read or modify another's data.

All Shopify webhooks are verified with HMAC-SHA256 on the raw request body before processing, and deduplicated by delivery ID.
Scheduled job endpoints require a secret bearer token.

All traffic uses HTTPS. The embedded app can only be framed by Shopify admin.
Data is stored in a managed PostgreSQL service with encryption at rest.
Secrets live in the hosting provider's encrypted environment configuration, never in source code.

Uninstall: syncing stops and credentials are deleted immediately.
Shopify's shop data-erasure request (48 hours after uninstall) permanently deletes all data stored for the store.

Failed jobs, failed webhooks, sync errors and unusual traffic trigger alerts to the operator.