Data privacy: what Store Decode collects, and never collects

Store Decode collects how your store’s pages are used: which sections are seen and for how long, clicks inside sections, and cart, checkout, order and search events. It never reads a visitor’s name, email address, phone number, postal address or payment details, nothing typed into forms apart from search words, and it makes no recordings. The privacy policy is the full text.

The method in plain words

Two pieces of code record what happens on your store.

• The script is loaded by the app embed on your storefront pages. It sees which sections come on screen, for how long, and where visitors click. It reads no form field and listens to no key press.
• Shopify’s web pixel runs in Shopify’s own sandbox, on your pages and your checkout. It listens to five of Shopify’s standard events: a product added to the cart, a product removed, checkout started, an order placed and a search. It cannot read or change your pages.

Both follow the cookie banner choices your store reports to Shopify, and both send what they record to Store Decode’s server.

What it means for you and your visitors

• No one is identified. A visit carries a random id from a cookie on the visitor’s device, never a name. In the app, each visit shows with a short tag.
• No recordings. The script does not copy the page and makes no screen recording.
• Analytics inside the app. The app’s own pages inside your Shopify admin may use analytics tools such as Google Analytics and Microsoft Clarity, to show us how merchants use the app. Those tools receive no visitor information from your storefront and none of your store’s figures.
• Consent is followed. A visitor who declines analytics in a cookie banner that reports to Shopify sends nothing. Each store chooses its own banner and how it presents the choice.
• You can stop it. Pause collection in Settings stops recording on your store, and uninstalling stops it completely. Visits are not recorded while collection is paused.
• No selling and no advertising. Store Decode does not sell information or use it for advertising, and never shows one store’s information to another store.

The script is built to have no effect on your pages. Does Store Decode slow down a Shopify store? explains how.

The exact rules

What the script records

• The page. Its address within your store, with the query string and fragment removed, its type and template, and the theme. On account, order, checkout and similar private pages only the kind of page is kept, never the ids or codes in its address.
• Its sections. Each section’s Shopify id and a label from its first heading, cut at 60 characters. Where the section sits, how long it was on screen, and its clicks and dead clicks.
• Clicks. The element clicked, as its tag, its first class name and a fingerprint of its text, never the text itself. A link’s path is kept when it stays on your store.
• Images and cards. A fingerprint and the Shopify file address of each image shown in a section. On collection pages, the product cards shown and clicked, with their position and product id.
• Product page and cart events. Gallery use, option changes, accordion opens, and whether the reviews, size guide or trust badges came on screen. Clicks on add-to-cart controls, with the variant id. In the cart, whether an upsell was shown or clicked, and whether the discount field was opened, never what was typed in it.
• Page facts your theme already publishes. Bare ids and counts: the product and variant ids on a product page, how many products a collection holds, how many results a search found.
• Speed and setup. How fast the page loaded, how far it scrolled, the device type, screen size and browser, and the page language.
• Where the visit came from. Once per visit, the address of the site the visitor came from, without its path, and the UTM campaign values on the link. Ad click identifiers are never read.

Store Decode’s server adds the browser’s user agent text and the time each page view arrived. Those signals help leave automated traffic out: see How Store Decode leaves bots out.

What the pixel records

• Cart adds and removes. The product and variant, quantity, value and titles.
• Checkouts and orders. The products, quantities, prices, discounts and, for an order, the Shopify order id.
• Searches. The words searched and how many products Shopify listed. Terms that look like an email address or a long number are removed before they are stored. Search words are still free text, so a visitor could type something else personal, such as a name, into your search box.

A discount code made for one person can be linked to that person in your store’s own systems. On Activity, a search term appears only on its own event, never in a list of searches.

Location and IP address

Where analytics is allowed for the visitor, Store Decode stores the IP address of the page view and the country and region Shopify detects in the browser. It looks up no location from the IP address and stores no city. The IP address is never shown in the app. Where no consent signal is available, the script may record page measurements without storing the IP address or location.

Cookies and browser storage

The script uses three first-party cookies on your store’s own domain:

• sd_sid, the random visit id. It ends after 30 minutes without activity.
• sd_attr, the last product section clicked, so a later order can be linked to it.
• sd_ignore, set only in your own browser when you choose Don’t count my visits in Settings. While it is there, the script sends nothing from that browser.

The script also keeps a few short-lived values for the current browser tab. No cookie is used for advertising.

Who receives information

Each receives only what it needs for its part of the service:

• Shopify, which runs your store, the app embed and the pixel.
• Hosting, database and storage providers, which run Store Decode’s servers and store its data.
• An AI service provider, which helps write the store audit and some descriptions in the app. It receives store information and totals made from many visits, never information about a single visitor.
• Email delivery providers, which deliver the emails you ask for.
• Analytics providers, for the app’s admin pages only.
• Public sources, which receive your store’s name or address as a search for the audit.

On uninstall and on request

When you uninstall Store Decode, Shopify tells the app, and your store’s data is deleted: audits, measurements, summaries and the access token Shopify gave it. Limited business records about your store and its install history are kept, as the policy describes. Shopify sends a further erasure request after the uninstall, and the deletion runs again then.

Store Decode stores no visitor names, email addresses or phone numbers, so it cannot find a person’s records by name or email. A visitor who wants to see or delete their information contacts your store first, which can pass the request on through Shopify.

See what Store Decode measures on a sample store