Script Tag Audit privacy policy

Who makes the app

Script Tag Audit is a Shopify app made by me, Hamza Ahmad Aslam, an individual developer based in Pakistan. This policy covers what the app collects when a merchant installs it, why, and what happens to it. The privacy policy for this website is a separate page.

For privacy questions or requests, email info@hamzaahmadaslam.com.

What the app collects

Store connection

When you install the app, Shopify gives it your store's domain and an access token limited to the permissions you approved (read_script_tags and read_themes). The app stores both so it can work without asking you to log in again.

Audit results

When you run an audit, the app:

• reads your store's live theme files through Shopify's Admin API;
• loads your public storefront home page, as any visitor would;
• downloads each third-party script it finds, once, to measure its size.

Theme files and the storefront page are processed in memory and not kept. The app stores the findings: script addresses, theme file names, the app or vendor behind each script, its status and size, and the time of the audit.

Storefront password

If your store is password protected, you can type the storefront password so the app can read the home page. It is used for that one audit, held in server memory only while the audit runs, and never written to the database or the logs.

Cleanup requests

If you send a cleanup request, the app stores the name, email address and message you enter and the findings you selected, and emails them to my support inbox so I can reply to you.

Billing

Shopify handles all payments. The app only asks Shopify whether your store has an active plan or a one-time purchase. I never see card or bank details.

The app does not collect information about your customers or their orders, and it uses no analytics, advertising or tracking cookies.

How the data is used

Only to run the audit, show you its results and history, answer cleanup requests, and keep the app working and secure. I do not sell or rent it, and I do not use it for advertising.

Service providers

• Shopify: the app platform, login and billing.
• Vercel: runs the app's server.
• Neon: stores the data described above.
• Resend: delivers cleanup request emails.

Each one processes the data only to provide its service. The app's server and database are in the United States.

How long data is kept

• Each time an audit finishes, the app keeps the newest 50 audits for your store and deletes the rest, along with any audit older than 180 days.
• When you uninstall the app, Shopify notifies it and the app deletes your store's access token at once. Your audit results and cleanup requests stay until the next step.
• 48 hours after you uninstall, Shopify asks the app to erase your store's data. The app then deletes all audit results, cleanup requests and any remaining store connection data.
• Emails about a cleanup request stay in my support inbox for as long as needed to finish the work and answer follow-up questions.
• Server logs can include your store's domain and the host names of the scripts an audit checked. Vercel keeps them for 1 day. The text of a cleanup request is not written to the logs.

Your rights

You can ask for a copy of the data held about your store, ask me to correct it, or ask me to delete it, by emailing info@hamzaahmadaslam.com. Depending on where you live (for example the EU, the UK or California), you may have further rights under data protection law, including the right to complain to your data protection authority. I answer requests within 30 days.

Shopify's data requests for your customers (customers/data_request and customers/redact) are acknowledged. The app holds no customer data to return or erase.

Security

Data travels over HTTPS. Access tokens and audit data are kept in a password-protected database that only the app uses. Each request an audit makes, to your storefront page or to a script it measures, is checked when the connection opens, and the app refuses private, internal and reserved network addresses. Your storefront password is sent only over HTTPS, and only to your own store.

Changes

If this policy changes, the date below changes with it. For a material change, I also tell merchants in the app.

Last updated: 19 October 2026