Privacy

What we read

Free scan: your store name, your public product pages, and what Shopify’s AI catalog says about your products. If you ask for alerts, your email address.

Installed app: your product titles, descriptions, tags and product details, through Shopify’s read-only product access. The email addresses you add for alerts. When none of your products are in Shopify’s AI catalog, we also read your Shopify plan, whether your storefront is password-protected, and each product’s status, price, images and publishing, to show which of Shopify’s published requirements are unmet. If you grant the optional publications access, we also read which of your sales channels (Online Store, Hydrogen, Headless) each product is published to, for the same reason. We keep that for about ten minutes, then discard it.

We never read your orders or your customers. We don’t ask Shopify for access to them.

What we keep

• Your store’s domain, and its name.
• The product text we need to compare: the claim lines from Shopify’s summary that we check, and a sentence or two of your own copy as the evidence for each finding.
• Findings and the numbers we work out from them: each claim’s finding type, category and severity, when it was first seen and when it went away, and a fingerprint of each listing so we can tell when it changes. We keep these while you use Hearsay, so we can show you what changed, and delete them as described under “Deleting your data”.
• The email addresses you give us for alerts, and your alert settings.
• For installed stores, the access token Shopify gives us, stored encrypted, and your billing status from Shopify. We never see your card.
• For installed stores, a short install record: when you installed, when your first check finished and whether it found your products in Shopify’s AI catalog, when you first saw findings, when you started a paid plan and which one, and when you uninstalled. It holds no domain, name or hash of either: only a random ID made up when you installed, plus those event times and the plan. We use it to count how many installs get to results.

What we never keep

• Customer data or orders.
• Product images. We don’t fetch, store or show them.
• Shopify’s raw catalog responses. We keep the claim lines we compare and throw the rest away.

Who sees it

Your report is yours. Anyone with the private link can read it, so share it on purpose. When we publish examples, we never name the brand.

A few service providers help run Hearsay, and each gets only what it needs:

• AI reviewers (TypeSafe and Anthropic) receive the product text we compare, to check each claim.
• Email delivery (Resend) receives your email address and the alert we send you.
• Hosting runs our servers and database.

We don’t sell your data, and we don’t use it to advertise.

Analytics

We count visits and a few actions, like starting a scan, opening a report or clicking install, with first-party analytics that run on our own servers. They don’t set cookies and don’t store your IP address. A visit is grouped by a one-way hash of a shortened IP address and your browser’s version string, which many people share, so it points to a visit, not a person. We keep the browser and device type, the site that sent you, and any campaign tags in the link. We also use Plausible, a privacy-friendly analytics service that sets no cookies and doesn’t collect personal data, to count page views. There are no ad pixels or other third-party trackers, and nothing is tracked inside the Shopify admin.

Deleting your data

• Emails: every email has a link to change or stop them.
• When you uninstall: straight away, we delete the access token Shopify gave us, end any paid plan, and stop checking your products and sending alerts. Your findings and settings stay for now, so a reinstall picks up where you left off.
• 48 hours after you uninstall: Shopify asks us to erase your store’s data, and we delete everything we hold for it: your store record, products, claims, findings, checks, reports, alert recipients and alert history. If you’ve reinstalled by then, we keep it. The install record above stays. Once your store record is gone, we keep nothing that names your store alongside its random ID, and a reinstall gets a new ID.
• Your customers: we never read them, so the only customer data we could hold is an email address you added as an alert recipient. When Shopify passes on a customer’s request for their data, we check whether their email is one of your recipients, and if it is, we send you what we hold within 30 days. When Shopify asks us to erase a customer, we remove their email from your alert recipients.
• Anything else: email [email protected] and ask for a copy of your data or for it to be deleted, including a free report. We’ll do it within 30 days.

Contact

[email protected]. Hearsay is independent and not affiliated with Shopify.