Some Apps are clearly mining your customer data

[TonyHatch]

I was looking into Shopify App development for my own site and found that Apps need to host the content themselves. I then wondered why would a company offer an app for free if they had to pay to host the backend. Then it hit me. They get access to all this data for free.

We are looking to move our website over to Shopify but are having doubts now as we may aswell redevelop our old store if we cannot use Apps due to privacy concerns.

Why is this not a bigger issue and why are Shopify not protecting their customers from this clear data mining practice?

I understand that some Apps will require access to customer info but the example above is from a popular Custom Fields app. There is no reason this app requires this information, it doesn't interact with customer info at all. I've checked lots of apps now and most of them do not require the information they are requesting.

Pressure needs to be put on Shopify to stop this practice.

[Shay]

Hi @TonyHatch 

Thank you for sharing your feedback and experience on this topic with our community in the forums. Shopify provides an app marketplace for approved applications to be listed by our community of experts and developers. While we have very strict processes in place to vet apps for their usability, safety and security, we do not directly vet apps for the data they collect. 

All 3rd party apps must provide a consent to data collection upon installation to your store and all apps listed in the app store must also have a privacy policy that details the data collected and how you can expect it to be used. 

Some app developers may choose to collect and sell collated data to help keep their app costs low, while others may choose to provide free apps without doing so. The decision on this is entirely in the app developers hands. It is the responsibility of the merchant to review the apps they are installing on their store and to contact the app developers directly to learn more. 

If you come across an app that you believe to be collecting data without merchant consent or without information in their privacy policy on how that data will be utilized, then please do reach out to our live support to report this. This information should be readily available for merchants at all times. 

[KPoss]

Seriously!  You are saying that Shopify knows and allows apps to mine and sell data from the merchant and that Shopify is okay with that as long as they state that in the privacy policy?

I am rethinking my store being on Shopify and will await your answer.  If this is happening, it should be explicit when installing an app.......Do you the merchant allow the app developer to sell your data?

[Shay]

Hi @KPoss 

Thank you for sharing your feedback here on this topic. The privacy of both yours and your customer's information is always an important subject and one I am happy to discuss. I do recommend reviewing our public resources to learn more about how Shopify works to protect sensitive data:

Shopify Help Center - App permissions and personal information 

Shopify Privacy Policy 

Shopify Terms of Service - Merchant 

When it comes to apps in the Shopify app store, we offer merchants a marketplace of apps to choose from to assist them in expanding their business and the features available to them. App developers have rigorous quality checks they need to pass before an app will be accepted into the app store. We will also review apps for unnecessary data access as well. 

Each app is independently owned and created, the relationship between the app and your store is one that Shopify is not directly involved in. We ensure the app is in good standing, follows our terms of service and acceptable use policy and we can also assist a merchant in contacting an app developer if they are having any issues doing so. We have no say in the relationship of your business and the app outside of that.

When installing an app you are provided a list of all data points the app will have access to and you must explicitly agree to that access before the app can finish installing. Once the app is installed you can review a full breakdown of all the data it is accessing by going to Settings > Apps and Sales Channels > Select the app. 

[Beset]

I can understand why you allow this from a commercial point of view, although I disapprove of the lack of transparency.
You should at least display the "privacy list of all data points the app will have access to" directly in the Shopify App store BEFORE you choose to install the app.
Furthermore, not sure if this is already there, but you should stipulate that the developers specify a set of all data points the app will have access to PER "Pricing" model they create, just like the feature sets.