Store Decode privacy policy

Effective date: 1 November 2026

This policy explains what information the Store Decode app collects, why we collect it, who receives it and how long we keep it. It is written for two groups of people:

Merchants who install Store Decode on a Shopify store.
Visitors who browse a store that uses Store Decode.

Who we are

Store Decode is a Shopify app made by Codilar Technologies Pvt Ltd, a company registered in India (“Codilar”, “we”, “us” or “our”). Codilar is a web development and e-commerce agency.

This policy covers the Store Decode app and its website, storedecode.com: the pages merchants open inside the Shopify admin, the script and web pixel the app adds to a store, the website, and the systems behind them. Codilar’s own website and services are covered by Codilar’s privacy policy at https://www.codilar.com/privacy-policy.

The short version

For merchants, we read store information through Shopify to provide the app: the store audit, the measurement pages and the reports. We also use store and account information to support and improve the app and to contact merchants about it and about related services.
For visitors, we record how the store’s pages are used, such as which sections are seen, clicks, cart, checkout, order and search events. We do not read visitors’ names, email addresses, phone numbers, postal addresses or payment details.
We do not sell information, we do not use it for advertising, and we never show one store’s information to another store.
When a store uninstalls the app, we delete its store data, apart from limited business records.

Information about merchants

When you install Store Decode, Shopify gives us your store’s domain and access to the information covered by the permissions you approve (such as products, orders and the web pixel). We also keep basic store and account details, such as the store name, contact email, plan, country, currency and time zone.

We use this information to:

Run the store audit. We read store information through Shopify (such as products and collections) and the store’s public pages. To describe the brand, we may look up the store’s name on public sources such as Wikipedia, Reddit and the Internet Archive.
Show the measurement pages and reports. We combine what the storefront script and pixel record with order and product information from Shopify.
Send emails. These include a welcome email and the reports you ask for.
Support and improve the app. This includes answering your questions, for which our team may view your store’s Store Decode data, understanding how the app is used, and contacting you about the app, about paid plans if we offer them in future, and about related services from Codilar.

On the storedecode.com website and on the app’s pages inside the Shopify admin, we may use analytics tools, such as Google Analytics and Microsoft Clarity, to see how they are used. These tools receive no visitor information from your storefront and none of your store’s figures. Our server keeps operational logs of requests to the app to keep it working and secure.

Information about visitors to stores that use Store Decode

A store that uses Store Decode turns on the Store Decode app embed in its theme. The embed loads our script on the store’s pages, and Shopify runs our web pixel on the store’s pages and checkout. Both send what they record to our server.

What is recorded

How pages are used. This includes the page address within the store, the page type, which sections appeared on screen and for how long, how far the page was scrolled, clicks inside sections, how fast the page loaded, the device type, screen size and browser, and the site or campaign the visit came from. On account, order, checkout and similar private pages we keep only the kind of page, not the ids or codes in its address.
Shopping events. These are cart adds and removes, checkout started and orders placed: the products, quantities, prices, discounts and the Shopify order id.
Searches. We record the words searched, after removing terms that look like an email address or a long number. Search words are free text, so a person could still type other personal details into a store’s search box.
IP address and location. Where analytics is allowed for the visitor, we store the IP address of the page view and the country and region that Shopify detects. We do not look up a location from the IP address, and we never show it to anyone.
Random ids. A random visit id and page view id link one visit’s events together. They are not linked to a name.

The script and pixel do not read names, email addresses, phone numbers, postal addresses, payment details, passwords or anything typed into forms (search words reported by Shopify are the one exception). They do not record screens or keystrokes.

Our script and pixel follow the cookie banner choices that the store reports to Shopify. When a visitor declines analytics in such a banner, nothing is sent. Where no consent signal is available, the script may record page measurements without storing the IP address or location. Each store chooses its own cookie banner and is responsible for how it presents these choices to its visitors.

Merchants can pause collection on their store at any time on the app’s Settings page, or stop it completely by uninstalling the app.

Cookies and browser storage

The script and pixel use a small number of first-party cookies and browser storage on the store’s own domain:

a visit id (sd_sid);
the last product section clicked, so a later order can be linked to it (sd_attr);
a setting that stops the merchant’s own visits from being counted (sd_ignore).

They also keep a few short-lived values for the current browser tab. We do not use cookies for advertising.

Automated traffic

To leave automated traffic out of the numbers, we use the browser’s user-agent text and a few signals the browser gives.

Who sees visitor information

The merchant sees this information in the app, as summaries and as lists of events for single visits. Each visit is shown with a short tag, never a name. The IP address is never shown in the app.

How we use information

To provide and operate the app and its features.
To keep the service working and secure: limit abusive traffic, find and fix errors, and prevent misuse.
To support merchants, understand how the app is used, improve it, and contact merchants about the app and related services.
To meet legal obligations.

We do not sell information, we do not use it for advertising, we do not build profiles of individual visitors, and we do not combine one store’s information with another’s.

Who receives information

We use trusted service providers to run the app. Each receives only what it needs for its part of the service:

Shopify, which runs the store, the app embed and the pixel.
Hosting, database and storage providers, which run our servers and store our data.
AI service providers (currently Google Gemini), which help write the audit and some descriptions in the app. They receive store information and totals made from many visits, never information about a single visitor. Their own terms apply to what we send them. Depending on the plan we use, these terms may allow the provider to use the content to improve its services.
Email delivery providers, which deliver our emails.
Support tools, which carry chat, messages and team notifications when you contact us.
Analytics providers (such as Google Analytics and Microsoft Clarity), for the website and the app’s admin pages only.
Public sources (such as Wikipedia, Reddit and the Internet Archive), which receive a store’s name or web address as a search for the audit.

We may also share information within the Codilar group to provide and support the app, with a buyer or successor if the business changes hands, or where the law requires it.

Where information is stored

Our servers and service providers may be in India or in other countries, including outside your own. Wherever information is processed, we protect it as described in this policy.

How long we keep information

We keep information only as long as we need it to provide the app, for legitimate business purposes such as support, security and our records, or as the law requires. In particular:

Store data is kept while the store has the app installed.
Backups and logs expire on their own schedules. Information we have deleted can stay in a backup until that backup expires.
Emails already sent stay in the recipients’ mailboxes.

When a store uninstalls the app

When a store uninstalls Store Decode, Shopify tells us, and we delete the store’s data (audits, measurements, summaries and the access token Shopify gave us), apart from limited business records about the store and its install history. Shopify sends a further erasure request after the uninstall, and we run the deletion again then. Backups expire as described above.

Requests about a person’s information

We do not store visitors’ names, email addresses or phone numbers, so we cannot find a person’s records by name or email. A person who wants to see or delete their information should first contact the store, which can pass the request on through Shopify. On request, we delete the information we hold that is linked to that person. You can also write to us at the address below.

Security

We take reasonable technical and organisational measures to protect information, such as:

encrypted connections;
restricted access to our systems and database;
strict separation of each store’s data.

No system is perfectly secure. If we learn of a breach that affects your information, we will take appropriate steps and notify those affected where the law requires.

Children

Store Decode is a tool for businesses. We do not knowingly collect information about children.

Changes to this policy

We may update this policy as the app changes. When we do, we update this page and the effective date at the top.

Contact us

If you have questions about this policy or about your information, or if something does not work as described, write to us at hello@codilar.com.