Legal

Privacy Policy

Last updated: August 13, 2026

1. Introduction

Uatu - The Store Watcher ("the App") is operated by Anatta Design Inc. ("we", "us", "our"). This Privacy Policy explains how we collect, use, and protect information when you install and use our Shopify application.

We are committed to protecting the privacy of Shopify merchants and their customers. The App is designed to be strictly read-only and collects the minimum data necessary to perform its audit function.

2. Information We Collect

2.1 Store Information

When you install the App, we access:

  • Store domain and name - to identify your store in audit reports
  • Published theme files - Liquid templates, CSS, JavaScript, and JSON files from your published theme (read-only, for code analysis)
  • Product count - a single number representing total product count (no product names, descriptions, prices, or images)
  • Locale and translation data - published locale codes and translation coverage percentages
  • Market configuration - market names and active/inactive status
  • Script tags - URLs of legacy script tags installed by other apps
  • Marketing event surfaces - marketing integration signals
  • File references - file URLs referenced within theme code

2.2 Information We Do NOT Collect

The App explicitly does not access, collect, store, or process:

  • Customer personal information (names, emails, addresses, phone numbers)
  • Order data (transactions, payment details, order history, fulfillment)
  • Product details (titles, prices, descriptions, images, variants)
  • Checkout or payment information
  • Discount codes, gift cards, or price rules
  • Inventory levels or warehouse locations
  • Staff accounts or user credentials
  • Customer browsing or purchase behavior

The App requests only read_ scopes. No write permissions of any kind are requested or used.

3. How We Use Information

The information we collect is used solely to:

  • Analyze your theme code for Horizon migration readiness
  • Generate audit reports including performance benchmarks, accessibility scores, and feature inventories
  • Provide AI-powered code analysis to identify custom features and migration requirements
  • Create migration requirements documents for your planning use

We do not sell, rent, or share your store data with any third parties for marketing or advertising purposes.

4. Third-Party Services

The App uses the following third-party services:

  • Anthropic Claude API - Theme code files are sent to Anthropic's Claude API for AI-powered analysis. Only theme code (Liquid, JavaScript, CSS) is sent - never customer data, order data, or personally identifiable information. Anthropic does not use API inputs for model training.
  • Google Lighthouse - Your store's public-facing homepage URL is tested through Google Lighthouse for performance, accessibility, and SEO metrics. This accesses only publicly available information.
  • Cloudflare - The App is hosted on Cloudflare Workers. Audit data is stored in Cloudflare D1 (database) and Cloudflare KV (key-value storage).

5. Data Storage and Retention

  • Audit results are stored in our database associated with your store domain
  • Theme file contents are processed during audit and not permanently stored in raw form
  • Audit reports (HTML documents) are retained until you delete them or uninstall the App
  • Per-store settings (such as preferred AI model) are stored in key-value storage

6. Data Deletion

When you uninstall the App, all stored data associated with your store is automatically deleted. This includes:

  • All audit run records and results
  • All generated reports
  • Session and authentication data
  • Per-store settings

You may also request data deletion at any time by contacting us at apps@anattadesign.com.

7. Shopify Compliance

The App implements all mandatory Shopify compliance webhooks:

  • customers/data_request - We acknowledge the request. Since we do not store customer personal data, no data export is produced.
  • customers/redact - We acknowledge the request. Since we do not store customer personal data, no data deletion is required.
  • shop/redact - We delete all data associated with the store upon receiving this webhook.

8. Security

We implement appropriate security measures to protect data:

  • All data in transit is encrypted via HTTPS/TLS
  • Authentication is handled through Shopify's OAuth flow
  • API keys and secrets are stored as encrypted environment variables
  • The App operates with minimal required permissions (principle of least privilege)
  • No customer PII is ever processed or stored

9. Children's Privacy

The App is a business tool for Shopify merchants and is not directed at children under the age of 13. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us: