Privacy policy
Your customers' personal data stays inside Shopify. This page says exactly what Lit Checkout Rules & Limits does process, and where it lives.
Last updated 24 August 2026
The short version
We operate no database. Your rules are kept inside Shopify, on your own store. The only thing that ever reaches a server of ours is a counter: an app of ours was opened, a rule was switched on — attached to a one-way hash of your shop's domain, and to nothing else.
What we process, in full
| What | Why | Kept |
|---|---|---|
A hashed shop id — SHA-256 of your .myshopify.com domain,
truncated to 16 hex characters |
To count distinct shops without knowing which shops. It cannot be reversed to a domain and we hold no table mapping it back. | 3 months |
| Five event names: app opened, rule created, rule switched on, test run, upgrade link clicked. Each is a count of one — there are no other fields. | To know whether merchants get as far as switching a rule on, which is the only number that tells us whether the product works. | 3 months |
Your plan tier (free or pro) and
page-performance timings (Shopify's own Core Web Vitals numbers for our
admin screens) |
To keep the app inside Shopify's performance requirements and to see where it is slow. | 3 months |
Shopify's compliance webhooks — customers/data_request,
customers/redact, shop/redact |
Verified and acknowledged as Shopify requires. We hold no customer data, so there is nothing to return and nothing to erase. | Not stored |
The event payload is a closed set of keys. Our server rejects any request carrying a key it does not recognise, so there is no free-text field through which an email address, an order, a shop domain or the contents of a rule could reach us even by accident.
What we never see
- No customer personal data ever reaches us. No names, emails, phone numbers, addresses or payment details arrive on any server of ours, in any form, at any time.
- Orders, carts and checkouts stay inside Shopify. Rules are evaluated by Shopify Functions running inside Shopify's own checkout. That code sends us nothing; it returns its answer to Shopify and stops. The app can read your own recent orders, but only in your browser and only when you ask it to — see below.
- No storefront tracking. The app ships no theme code, no app embed, no script tag and no app proxy. Nothing of ours runs on the page a shopper looks at.
- No rule contents. Your rules live in your shop's metafields. We can only read them while you have the app's admin page open, in your browser, under your own staff account's permissions.
The two places your shopper's details are read
At your checkout, while a rule runs. A rule about a shipping address or a tagged customer has to be able to look. When your checkout runs one, Shopify hands the rule the fields it names — the shipping address lines, country, province and postcode, and a yes/no for each customer tag you typed into the rule — and the rule answers block or allow. All of that happens inside Shopify's own checkout runtime, in the milliseconds of that one checkout. Nothing is written down, nothing is sent anywhere, and no server of ours is contacted: our code has no network access at that moment and never receives the shopper's details. If you never write an address or customer-tag rule, those fields are never read at all.
In your browser, when you test a rule against one of your own orders. The Test and Diagnostics screens can fill a test cart in from a recent order, so you can ask "what would my rule have done to that checkout?" without guessing. When — and only when — you press that button, your browser asks Shopify for your last 20 orders (order number and date, nothing else), and then, for the single order you choose, for the fields a rule can actually read: the items and quantities, the same five shipping-address lines listed above, your customer's tags, and the order total. Never a name, an email address, a phone number, a billing address or any payment detail — they are not requested, so they are not returned. The response goes to the rule simulator running in that same browser tab and is gone when you leave the page: not stored, not cached, not sent to us or to anyone else, and no server of ours is involved at any point in it. If you never press that button, no order of yours is ever read.
Where your rules are stored
In four app-owned metafields on your shop, inside Shopify — the full record plus the three compiled versions the checkout reads. They are covered by Shopify's own security and data-residency arrangements, not ours. Uninstalling removes our access to them.
Access, permissions and sub-processors
The app requests only the permissions it needs to do its job: manage checkout, payment and delivery customizations; read products and collections (to turn "this collection" into the list of products a checkout can compare against); read customer tags (so the checkout can answer "is this shopper tagged wholesale?" for the tags your own rules name — the tag list is never read into the app, and the answer never leaves Shopify); read shipping rates (to list your own delivery option names in the rule builder); and read orders, which is used for one thing only — the "test against a recent order" button described above, in your browser, on the orders you pick. That permission reaches the last 60 days; the app does not ask for access to older orders.
Our only sub-processor is Cloudflare, which serves the app's static admin page and stores the counters described above. There are no analytics vendors, no advertising networks and no third-party scripts in this app.
Your choices
Uninstalling the app from your store ends all processing immediately. Counters already recorded carry no identifier that can be traced to you, and age out within three months.
Security and what happens if something goes wrong
The app holds no customer personal data, so there is no store of it to lose. Every connection is served over TLS; the one secret the app keeps — the credential it verifies Shopify's webhook signatures with — lives only in Cloudflare's encrypted secret store and is never written to a file or a repository. Access to every system involved is limited to Lit Dog Labs' owner.
If we suspect an incident, this is what we do, in this order: rotate the app credentials and revoke the automation tokens; roll the affected Worker and app version back to the last known-good release, both of which are one command; establish from Cloudflare's request logs and Shopify's own function-run records what was reached; and notify affected merchants and Shopify by email within 72 hours of becoming aware, whether or not the cause turns out to be ours. Reports are welcome at support@lit.dog and we reply within two business days.
Contact
Questions, or a data request of any kind: support@lit.dog. We answer within two business days.