SecurityPermissions and privacy

Designed to inspect stores, not access private business data

Chrome asks you to approve a set of permissions before ShopGrade can do anything. This page explains what each one is for, in plain language, and what ShopGrade does not do with it.

  • Dormant until you consent
  • Reads public pages, never writes
  • No store login or admin access
01The short version

What ShopGrade can and cannot see

One thing it reads, on pages confirmed to be Shopify storefronts. Everything else stays out of reach.

What it reads
  • Public storefront contentVisible text, page structure, URLs, resource timing and performance signals, on pages confirmed to be Shopify storefronts.
What it never touches
  • Form values and passwordsNever read on any site you visit, not from a store and not from anywhere else. The only password ShopGrade ever receives is the one you type into its own sign-in form: it authenticates you, and our authentication provider stores it only as a hash.
  • Orders, customers and paymentsThese live behind the Shopify admin, which ShopGrade has no access to and never asks for.
  • Your browsing historyNot collected. Once you consent, ShopGrade checks the pages you open for Shopify markers and grades confirmed storefronts on the toolbar. It keeps no record of the other sites you visit, and a full audit only runs on the tab you choose.
  • Network request and response bodiesNever read. Resource timing is measured, but the contents are not.
  • Any ability to change a storeShopGrade only reads. It never writes to a store, edits a theme, installs anything or submits a form.
02Permission by permission

What Chrome asks you to approve

These are the exact permissions in the extension manifest, and why each one is there.

Access to sites you visit over HTTPShttps://*/*

This is the broadest permission ShopGrade requests, and the one worth the most scrutiny. It exists because ShopGrade cannot know in advance which addresses are Shopify stores. Any domain can be one: most stores run on their own custom domain, not on a myshopify.com address, so there is no narrower pattern that would still let the extension work on your clients' stores.

What the extension actually does with it is much narrower than what it is allowed to do. It stays dormant until you consent. It then checks whether a page is a Shopify storefront, using domain, asset and theme markers. On anything that is not one, it stops there and the popup tells you the page does not appear to use Shopify. A full audit only ever runs on the tab you explicitly click Generate full report on.

Scriptingscripting

Used to run the audit inside the storefront tab so that page structure, headings, images, links and performance timings can be measured the way a real visitor's browser experiences them. Measuring from the outside would produce a different, less honest answer.

Storagestorage

Holds your settings, your branding and your local audit history in the browser. On an individual plan this stays on your device. On an Agency workspace, the client data you choose to sync is shared with the seats on that workspace.

Identityidentity

Powers Sign in with Google, so you can create an account without inventing another password. It gives ShopGrade your basic profile for sign-in and nothing else.

Context menuscontextMenus

Adds the entry Audit this store with ShopGrade to the right-click menu, so you can start an audit without opening the popup first. It routes through the same consent step as the popup does.

03After the scan

How reports and data are handled

How the report is handled

Reports are generated server-side and tied to your account, so your plan and your remaining generations survive a reinstall. Every report is private to your account and opens only for you until you choose otherwise. Free reports cannot be shared at all. On a paid plan or a report credit you can open a public link, which works for anyone holding it for 15 days and then returns the report to private on its own; each report can be shared twice. You can delete a report immediately from your account at any time.

A person you share a report with sees the findings, the evidence, the scores and your branding. They do not see your account, your other reports or anything else about your workspace.

Website analytics

This website loads Google Analytics only if you accept it in the banner. The extension itself does not load analytics at all. You can change your choice at any time from the cookie settings link in the footer.

Auditing stores you do not own

ShopGrade works on any publicly accessible Shopify storefront, which is what makes prospect audits possible. That capability comes with a responsibility that stays with you: you are responsible for using reports lawfully and for respecting each store's terms and rights. The full terms are in the Terms of Service.

Read the full privacy policy Add to Chrome