When you install an app, Shopify shows you a screen that says "this app will access the following areas of your store." It lists a lot of items, some of them in technical language, which makes it an easy screen to skim past.

But skipping it repeatedly leads somewhere specific: you lose track of how many external services currently hold your customers' information.

This article sticks to what Shopify's official documentation states, and covers what data apps can actually read and write, where in your admin you can verify it, and what happens to that data after you uninstall.

The short answer: there are only three places to look

There are three screens where an app's data access is visible.

The install screen is the only one you can see before installing. According to the Shopify Help Center, it displays two categories — "View personal data" and "View and edit store data" — and you can expand each to see the specific permissions being requested. A link to the developer's privacy policy sits on the same screen.

Each app's about page, under Settings > Apps in your admin, is where you can go back and check at any time after installing. The "Activity and permissions" section lists which areas of your store the app can view or edit, along with the date of its most recent activity in each area.

Settings > Customer events is where you check the data-sharing setting for pixels that apps have installed. This is managed separately from permissions, which makes it easy to overlook.

Worth noting: the place Shopify points you to for pre-install review is the install screen, not the listing page. You can compare pricing, features, and reviews on the App Store listing, but the scope of data access isn't reliably visible until you click "Install." That makes it awkward to factor into your evaluation at the comparison stage.

The two categories on the install screen

The "View personal data" category lists the types of personal information the app can read. The Shopify Help Center groups the personally identifiable information apps can access into four types.

Customer personal information covers contact details such as name, email address, phone number, and address. Apps that handle orders, fulfillment, or shipping also access location information such as IP address and geolocation, plus user agent information such as browser and operating system.

Store owner personal information includes all of the store owner's contact information, along with the addresses of every location.

Staff personal information covers staff names, email addresses, and phone numbers.

Content provider personal information covers blog authors and commenters, including email address and IP address, plus user agent information. If you're evaluating a blog-related app, it's worth checking whether this category appears.

The same document also states that every app you install has access to PII about your Shopify account, including your contact information and location. That happens regardless of what the app does.

After installing: "Unused access" is the useful signal

For auditing apps you already have, the most practical section is "Activity and permissions."

According to the Shopify Help Center, this section shows the areas the app can view or edit along with its most recent activity date in each. Hovering over an area name gives a more specific description of what the app can access there, and clicking a recent activity date shows the number of view and edit requests the app has made in the past 30 days along with the date of the last request.

And any permissions the app hasn't used in the last 30 days are grouped into an "Unused access" subsection.

That makes a useful starting point for an audit. An app holding read access to customer information that hasn't read any of it in 30 days raises a reasonable question: is that permission necessary, or is the app itself no longer in use? The method the documentation gives for revoking data access is uninstalling, so that's where the decision leads — but it's enough of a signal to cut down on apps that are simply sitting there.

There is one limitation. The same document notes that app activity and permissions are currently tracked only for third-party apps. Apps made by Shopify are closely linked to Shopify features, so their activity can't currently be tracked, and you won't learn anything about their usage from this screen.

The "Privacy" section sits on the same about page. It groups the personal data an app can access into categories such as "Customers" and "Staff and contributors," and links to the developer's privacy policy.

What Shopify restricts on the developer's side

Permissions aren't determined solely by what a merchant approves. Shopify also constrains developers.

According to the shopify.dev document on working with protected customer data, public apps fall into three levels depending on the customer data they use.

Level 0 apps use no customer data and require no additional action.

Level 1 apps use customer data excluding name, address, phone, and email fields. They must request access to protected customer data in the Partner Dashboard and implement the level 1 requirements.

Level 2 apps use customer data including name, address, phone, or email. Beyond requesting the data itself, they must request each of those four fields individually, implement both the level 1 and level 2 requirements, and participate in data protection reviews.

Shopify approves an app only for the minimum amount of data required for it to provide the functionality. Fields that aren't approved are redacted from API responses. In the document's own example, an app not approved for phone numbers that queries a customer's phone number still gets HTTP 200, but the value comes back as null with an accompanying error message.

The substance of those requirements is itself useful when choosing an app. Level 1 includes applying retention periods, encrypting data at rest and in transit, limiting processing to stated purposes, and informing merchants what data is processed and why. Level 2 adds encrypted backups, separation of test and production data, limited staff access to protected customer data, an access log for protected customer data, and a security incident response policy. Public apps that handle customer names or email addresses are required to meet at least that bar.

The document also lists the characteristics that make an app more likely to be selected for a data protection review: a high number of merchant installs, a high volume of customer records, more protected customer fields approved, and long retention of personal data.

"Recent orders" and "all orders" are not the same thing

There's one distinction worth watching when installing an app that handles order data.

According to the Shopify Help Center, apps that use order data request permission to access either recent orders or all orders. An app with permission to access recent orders can only reach the last 60 days of orders. An app with permission to access all orders can reach any past and future order.

The same document notes that Shopify reviews apps requesting access to all orders to confirm the data is genuinely required. In other words, these two sit under the same heading of "order access" but differ enormously in scope.

Custom apps haven't been through review

Everything above concerns public apps. Custom apps built for you by a development partner work differently.

According to the same shopify.dev document, both level 1 and level 2 are "always available" for custom apps — they can access protected customer data without the review process that public apps go through. Apps installed only on development stores don't need to submit a request for review either.

That said, custom apps created in the Shopify admin do carry a plan requirement for level 2 PII access. The Shopify Help Center states that to access Custom Level 2 PII apps your store must be on the Grow plan or higher, and that signing up for or downgrading to the Basic plan removes that access.

Installation works differently too. Custom apps are installed through an individual link supplied by the developer, and that link expires after seven days for security reasons. Because they don't go through an App Store listing, there's no third-party review step — worth keeping in mind as a baseline.

App pixels are managed separately from permissions

There's one more data flow that doesn't appear on the permissions screen: pixels installed by apps.

According to the Shopify Help Center, app pixels have two data access settings. "Always on" means the pixel has access to all of your customer and business data without limitations. "Optimized" means Shopify adjusts access dynamically based on analytics and campaign performance.

Under "Optimized," when Shopify detects that a marketing pixel is sharing more data than needed, it can pause some or all of that sharing. The example in the document is a clear one: you try a marketing app for a few months, stop using it, and let the subscription expire — meanwhile the pixel still has access to all of your data until you remember to disconnect it. With "Optimized," data sharing pauses automatically after a long enough period of inactivity.

App pixel data access defaults to "Optimized." A warning icon appears next to any "Always on" pixels that aren't referring traffic to your store. Some types of app pixels, such as those from analytics apps, can't be optimized and retain "Always on" access.

You can review the history of these changes from each pixel's detail page under Customer events. According to the same document, that activity log captures data access changes from June 3, 2026 onward — earlier changes aren't included.

What happens to your data after you uninstall

Per the Shopify Help Center, uninstalling is the way to revoke access. What follows has a defined timeline.

48 hours after uninstalling, Shopify sends the developer a request to erase all of the customer personal information the app collected during installation. As shopify.dev describes it, this arrives as the shop/redact webhook, carrying the store's ID and domain.

The developer must complete the action within 30 days of receiving the request — unless they're legally required to retain the data.

The Shopify Help Center adds an important caveat: to confirm that the requested data was actually deleted, you need to check with the app's developer directly. Shopify's role ends at sending the request; it doesn't guarantee the deletion is carried out.

The same applies when you request erasure for an individual customer: the request goes to every installed app that might hold that customer's information. Per shopify.dev, if a customer hasn't placed an order in the past six months the payload is sent 10 days after the deletion request; otherwise the request is withheld until six months have passed.

An erasure request submitted from the Shopify admin can be canceled within 10 days. Note also that this operation redacts personal information such as name and address — the customer profile and order history remain in your admin. Deleting the profile entirely is a separate action.

One more caution around erasure: if you erase personal data for a customer with active pre-authorized payments such as pre-orders or subscriptions, the remaining payments aren't charged and subscription contracts are canceled.

A checklist for installing and auditing

• Does the install screen's "View personal data" list anything you wouldn't expect from the app's function?
• Is order access limited to "recent orders" (60 days), or does it cover all orders?
• Does an app unrelated to blogs or comments request content provider personal information?
• Does the developer's privacy policy state retention periods and the deletion process?
• Do any installed apps show customer-data permissions under "Unused access"?
• Are any pixels under Customer events still set to "Always on"?
• For custom apps, does your store meet the Grow plan requirement for level 2 PII?
• Do you have a process for confirming deletion with the developer when you remove an app?

Summary

Three points to take away.

First, make data access part of your evaluation, not an afterthought. It isn't reliably visible on the App Store listing, so without deliberate attention you'll reach installation without ever having looked. The install screen is the one screen worth reading before you click through.

Second, use "Unused access" as your audit entry point. A permission unused for 30 days is a concrete prompt to reconsider whether you're still using that app. Apps made by Shopify are outside this tracking.

Third, don't treat uninstalling as the end of it. Uninstalling revokes access, but erasure of the data held by the developer runs through a 48-hour request and a 30-day window, and Shopify can't confirm completion for you. Framed as a vendor you handed customer data to, following up isn't unreasonable.

For what remains on your store's side after removing an app, see A Guide to Auditing Your Shopify Apps. For the billing side, see Why Shopify App Costs Don't Match the Estimate, and for performance, Do Shopify Apps Slow Down Your Store?.

This article reflects Shopify's official documentation as of August 31, 2026. Specifications can change, so check the latest information before installing.