Privacy policy

Last updated: 4 November 2026

Hitchscan is a free Shopify app that audits your store and shows you how to fix what it finds. This policy explains what information we collect, how we use it and the choices you have. If you have a question, email us at hello@hitchscan.com.

Information we collect

• Store information from Shopify. When you install Hitchscan, Shopify gives us read-only access to the store information we need to run the audit, such as your store name, domain and contact email, products (prices, costs, barcodes and stock), sales channels, theme files, discounts, store locations (to check which ones fulfil online orders) and your themes (to compare a theme with the live one before and after you publish it). If your store is password protected and you enter the storefront password in Settings, we store it encrypted and use it only to open your store for the audit.
• Orders and returns from Shopify. With your permission, Hitchscan reads the last 60 days of orders and the last 90 days of returns to work out totals and counts: how much of your sales goes to discounts and refunds, which discount codes are used most, how many customers order again and after how long, how fast products sell, and why products are returned. We don’t request customers’ names, email addresses, phone numbers or postal addresses. An anonymous customer ID is used only during the audit, to count repeat orders, and isn’t stored. We keep only the totals and counts in your report.
• Your public storefront. We visit your store the way a shopper would and record what we find, including page content, load times and screenshots used as evidence in your report.
• Information you give us. If you request a free audit on this website, we audit the public store address you enter and email the results to the address you give. We keep your email, the store address, the date and whether you asked for tips. If you contact us, we keep what you send so we can reply. To stop abuse we also keep a scrambled (hashed) version of your IP address and your browser type, and delete both after 30 days.
• Connected tools (optional, read-only). You choose which tools to connect. We only read, never change anything, and we store the keys and sign-in tokens encrypted. You can disconnect at any time in Settings, and we then delete the stored credentials.
  • Klaviyo: your flows, campaigns and sign-up forms, including their settings, send dates, delays, audience names and sizes, totals such as open, click and unsubscribe rates, and the subject lines and text of your marketing emails, so we can review how they are written. We don’t read your subscriber list or individual subscribers’ details.
  • Google (Analytics, Search Console, Merchant Center and, if you choose, Google Ads): totals for your store such as traffic, conversions, search queries, product feed problems and ad performance, and Google’s index status for a few of your product pages.
  • Meta (Instagram Business, Facebook Pages and Meta Ads): your posts and their dates, captions and hashtags, totals such as reach and engagement, public comments on your posts (to spot unanswered customer questions) and ad performance. We don’t read private messages.
  • Microsoft Clarity: totals for each page, such as sessions, rage clicks, dead clicks and quick exits. We don’t read session recordings.
• Your use of the app. Things like which findings you mark as fixed or hide, and your settings, so the app works as you expect.

Hitchscan does not read your customers’ contact details or any payment details.

How we use it

• To run your audits, build your reports and check your fixes on the next audit.
• To send you your monthly report and service emails. You can turn report emails off in Settings.
• To send the free audit you asked for on this website. We only send other emails, such as occasional Shopify tips, if you ticked the box, and every email has an unsubscribe link.
• To answer your questions and requests for help.
• To keep Hitchscan secure and to improve the checks.

We don’t sell your information and we don’t use it for advertising.

Who we share it with

We use a small number of service providers to run Hitchscan: Fly.io (app hosting and screenshots), Neon (database), Netlify (this website), Resend (email delivery) and Google Workspace (our mailbox). They process data only on our instructions. Two of them see your public store content: Google PageSpeed Insights receives the addresses of your public pages to measure their speed, and an AI provider (Anthropic or OpenAI) receives the visible text of your public store pages, up to three product images and, if you connect Klaviyo, the subject lines and text of your marketing emails, to check them for mistakes and unclear wording. We never send them customer data or data from Google, and under their business terms these providers don’t use it to train their models. We may also disclose information if the law requires it.

Google user data

Hitchscan’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to show you findings about your own store. We don’t sell it, use it for advertising, use it to train AI models or send it to AI providers, and no person reads it unless you ask us to, it is needed for security, or the law requires it.

Cookies

This website doesn’t use advertising or tracking cookies. Its fonts load from Google Fonts, so your browser shares your IP address with Google when you open a page. If this changes, we’ll update this policy.

How long we keep it

We keep your store’s audit data while Hitchscan is installed. When you uninstall the app, audits stop straight away and we delete your store’s data within 30 days, unless the law requires us to keep something longer. Free audits requested on this website are deleted after 30 days. We keep the email you gave until you ask us to delete it. If you unsubscribe, we keep it only to make sure we don’t email you again. We also respond to Shopify’s data-protection requests for store and customer data.

Your rights

Depending on where you live, including under the GDPR and California law, you can ask to see, correct, export or delete the personal information we hold about you, and object to how we use it. Email hello@hitchscan.com and we’ll reply within 30 days. You can also complain to your local data protection authority.

Security and transfers

We protect your data with encryption in transit and access controls. Your data is stored in the United States, and our providers may process it in other countries; where needed, we rely on safeguards such as standard contractual clauses.

Changes to this policy

If we change this policy in a meaningful way, we’ll update the date above and let you know in the app or by email.