How safe are Shopify apps? Permissions, data access, and what to check before installing

In short

Every Shopify app shows, before installation, exactly what data it can see and which parts of your store it can edit — that’s a requirement, not an option. Shopify also reviews every app before it’s admitted to the App Store, checking among other things for minimal permissions and encrypted data transmission. What that review doesn’t cover: how securely the provider runs its own servers afterward. That’s exactly what went wrong with the cookie-consent app Consentik in 2025 — not Shopify’s review itself, but a publicly reachable server on the provider’s side.

The problem, in merchants’ own words

The same question keeps resurfacing on the Shopify Community in different forms: “Are apps from the App Store safe?”, “What data can an app actually see?”, “Is there a foolproof method to check whether an app is trustworthy?” The reason: many apps ask for access to customer data, orders, discounts or store analytics at install time, and merchants often can’t tell whether that matches the advertised function or goes well beyond it. One recurring thread on this — apps asking for customer data access with no way for the merchant to track who’s pulling what — sums up the underlying frustration: the functionality is useful, but the visibility into what happens to the data afterward is not there.

What Shopify does natively

Before installing: every app shows an install screen with two sections. “View personal data” lists the types of personal data the app can access (for example customers, staff, or blog commenters). “View and edit store data” lists the areas of your store the app can view or change — for example customers, products, orders, discounts, gift cards, marketing, or store analytics. For especially sensitive customer fields — name, address, phone number, email — an app additionally needs Shopify’s separate approval to access protected customer data; without that approval, the API simply doesn’t return those fields.

After installing: Settings › Apps and sales channels › click the app. Under “Activity and permissions” you’ll see which areas the app can view or edit, plus its actual Admin API usage over the last 30 days, broken down by area. Permissions the app hasn’t used in that period show up separately as “Unused access” — a good first signal for which rights an app doesn’t actually need.

When uninstalling: the app loses access immediately. Shopify typically sends the provider a request after 48 hours to delete all personal customer data the app collected.

Where Shopify’s coverage ends

• The App Store review is an admission check, not ongoing oversight. Before publication, Shopify requires every provider to, among other things: request only the permissions the app actually needs, use optional permissions only for features not every merchant needs, and transmit all data encrypted with a valid TLS/SSL certificate. How the provider runs its servers afterward — whether access tokens are stored securely, whether internal systems are hardened — isn’t checked on an ongoing basis.
• The Consentik case shows the gap concretely. In 2025, a security team found a publicly reachable server belonging to the app Consentik that had been sending Shopify admin access tokens and Facebook ad-account tokens unencrypted for months — at the time, the research put the app’s install base at over 4,180 Shopify stores. Anyone who captured one of those tokens would have had full admin access: change prices, view customer data, inject code. The app itself was listed in the App Store, carried Shopify’s “Made for Shopify” badge, and had a high rating; the problem wasn’t the permissions it requested, but how the infrastructure behind it was secured.
• The Community’s own assessment is honest: there’s no foolproof method to certify any app as safe in advance, according to the discussions on the Shopify Community. What’s left is checking it yourself — matching permissions against function, reading the privacy policy, uninstalling apps you no longer use.

What signals a data-minimal app

There’s no fixed rule, but a set of signals you can check before and after installing:

If …	then …
an app for its function (e.g. shipping-rate calculation) requests “View and edit customers” when it only needs the postcode	check the privacy policy for why — or ask the provider before installing
a store area shows up as “Unused access” under “Activity and permissions” after a few weeks	check whether the app really needs that permission — ask support or uninstall
the privacy policy discloses that customer address data is stored permanently or shared with external mapping services	weigh whether that’s necessary for the feature offered — more data-minimal alternatives often exist
an app has been installed for months but is unused	uninstall it — every installed app is an additional access point into your store

Data minimalism also shows up in an app’s own privacy policy. KM Distance Shipping — the second app from this business — never stores customer delivery addresses: postcode and country are used only transiently, in memory, during the shipping-rate calculation, never stored, cached or logged. It doesn’t use an external mapping service like Google Maps — coordinates are looked up in a locally bundled dataset. On uninstall, all stored shop data is deleted completely. That’s something you can check in any app’s privacy policy, not only this one.

What to watch for

• Match permissions against function. An app that calculates shipping rates doesn’t need write access to discounts. If something doesn’t line up, ask the provider or skip the install.
• “View” is less risky than “edit”. Read access can expose data; write access can also change your store — both matter for the assessment.
• Read the provider’s own privacy policy, not just Shopify’s. The install screen shows what the app has access to; what the provider actually does with that data is in its own policy, linked from the install screen.
• Clean up regularly. Uninstall apps you no longer use, and occasionally review “Activity and permissions” for the rest — every installed app with admin access is an added risk, regardless of its rating.
• A good rating isn’t proof of security. Consentik had a high rating and Shopify’s “Made for Shopify” badge — both say something about function and support, nothing about the server security behind the scenes.