A privacy policy for your Shopify store

What the store reviewer checks

These checks come from the store's published rules. Open each source before you submit. The scan above checks your website, not your app or extension.

1. The policy linked from the listing

   Shopify asks apps to provide a privacy policy and link to it from the App Store listing. This applies to full and limited visibility apps.

2. What the policy explains

   Shopify lists how you collect data, why you use it, how long you keep it, where you store it and how merchants contact you.

3. The three privacy webhooks

   Apps in the App Store must handle customers/data_request, customers/redact and shop/redact, even if the app stores no personal data. Shopify sets 30 days to act.

What to account for

1. For merchants: review the configured policy

   Shopify’s Customer privacy settings manage policies, cookie banners and opt-outs. Review defaults and third-party services; automated text still needs to reflect your operations.

2. For consent integrations: use the actual signal

   The Customer Privacy API exposes consent choices to integrations. A visually correct banner is insufficient if pixels ignore those choices.

3. For app developers: a separate policy

   Apps listed in the Shopify App Store need a policy link. Explain API data, direct collection, purposes, retention and contact details.

Common mistakes to check

1. Assuming every third-party pixel is governed

   Shopify’s banner governs Shopify-specific tools. Manually installed third-party cookies or pixels can need additional integration or logic to honor consent.

2. App developers skipping privacy webhooks

   Public apps must handle the mandatory privacy webhooks. Verify authenticity, process requests and test the handlers; a policy page alone does not implement data rights.

Your review checklist

Our suggested review process. The linked requirements above explain the platform or legal basis.

1. Inventory storefront and operations

   List installed apps, pixels, payment and shipping services, newsletter forms, markets and customer support tools. Ask the owner to confirm backend handling.

2. Compare the draft with Shopify settings

   Scan the public storefront. Review suggested vendors, fill the unanswered business facts, and compare the draft with the current Customer privacy settings.

3. Exercise each customer choice

   Test the storefront, cart and available checkout journey after accept, reject and later withdrawal. Check network activity as well as banner appearance.

Example

1. Fictional store: Harbor Goods

   Assume physical goods, a shipping provider and a newsletter app. The scan observes a marketing pixel; the owner separately confirms fulfillment records and newsletter retention.

2. A useful next action

   Record why each vendor receives data, remove unused integrations, then review the draft against the store configuration. Compare consent choices with actual pixel requests before publishing.

Questions before publishing

1. Can I keep Shopify’s policy?

   Shopify supports an automated policy or manual content. Review it for your actual practices; do not assume a second policy is necessary merely because you ran a scan.

2. Does a public app with no stored data need webhooks?

   Shopify requires public apps to subscribe to the mandatory privacy topics even when they do not collect personal data.

3. Does this replace a merchant’s policy with an app policy?

   No. These describe different operators and processing. Start with the merchant workflow for a store; app developers must document their own app’s practices.