About This Policy

This policy explains what Shopify Shark (the Chrome extension built by Hyper Cavs Studio, “we”, “us”) does with information when you use it, and what our website does. “You” is the person running the extension or visiting this site. The extension is a tool for Shopify store owners, operators and researchers: it tells you whether the page you have open is a Shopify store, and which third‑party apps that store appears to use.

App Detection — What the Extension Reads and Sends

This is the core of Shopify Shark, so we want to be precise. When you open the extension on a tab, two things happen, in very different places:

In your browser, on the page you already have open: the extension reads that page's own HTML to (a) decide whether it is a Shopify store, and (b) collect app signatures — app identifiers present in the page's public markup — together with the hostnames of third‑party scripts the page loads. This reading happens locally; nothing leaves your machine at this step.
When you run app detection, the extension sends a single request to our server with exactly three fields:
- the URL of the store page you are viewing;
- the app signatures found in that page's markup;
- the third‑party script hostnames that page loads.

All of this is information that is already public on the webpage. Anyone who visits the same page in any browser can see the same markup and the same script hostnames. We do not extract anything private or hidden from the page — no form contents, no account data, no cookies.

Our server uses those three fields only to do a read‑only match against our app library and to return the matching app names and icons. The server does not crawl or browse the store itself. The page URL may also be placed in an aggregate, de‑identified queue that we use to keep our app library up to date; it is not linked to you or to any account.

One‑time consent. Because detection sends the page data above to our server, the extension asks for your agreement once, the first time you detect apps, before any request is made. The dialog lists exactly what is sent and links to this policy. If you agree, later detections proceed without asking again; if you decline, no detection request is sent. You can revoke this at any time by clearing the extension's stored data in Chrome.

What is never sent, now or ever: your name, email address or Google account; your login credentials, passwords, cookies or session tokens; your browsing history on other sites; anything you type into forms; and any payment information.

Store Data You Choose to Export

Shopify Shark can also read a store's public product and collection listings (the same data Shopify publishes at /products.json and /collections.json) so you can export them to CSV. Those requests go directly from your browser to the store you are viewing, not through our server, and the resulting files are saved to your own computer. We do not receive or store the products you export.

Optional Account (Google Sign‑In)

You do not need an account to use app detection or export. Signing in with Google is optional and is used only to manage an optional Premium licence. When you sign in, Google shares your email address with us so we can check and issue your licence; we never receive your Google password. If you never sign in, we never receive an email address from the extension.

Cookies & Local Storage

The extension stores a small amount of data on your own device using Chrome's storage: your preferences (for example export format and whether detection results are cached), your one‑time detection consent, and — only if you turn it on — a local cache of recent detection results so the same store opens instantly for 24 hours. This data stays on your device.
The website may place cookies and use standard web beacons to remember your session, measure how the site is used, and improve it. You can block cookies in your browser settings; doing so may limit some website features but does not affect the extension's app detection.

How We Use Information

To run the features you ask for: detecting apps, identifying Shopify stores, and exporting store data.
To keep our app library accurate (using the aggregate, de‑identified page‑URL queue described above).
To manage optional Premium licences and billing, and to answer support requests.
To send service messages about the extension (for example security or compatibility notices). Promotional messages are only sent if you opt in.
To improve and secure the extension and website, including fixing abuse and errors.

Sharing & Disclosure

We do not sell your information. We share information only with the small set of vendors that host and run the service (for example our server and payment processor), under obligations of confidentiality, and only as needed to provide the service. We may also disclose information where required by law, court order, or to protect our rights and safety, or in connection with a merger or sale of the business (in which case the same privacy obligations transfer).

Your Rights & Data Retention

You can clear the extension's stored data (preferences, consent and any local cache) at any time from Chrome's extension settings, and you can uninstall the extension to remove it entirely. Data held on our server for the app library is aggregate and not tied to you. Where we do hold personal information (for example a signed‑in email), we keep it only as long as needed for the purpose above, and you may email us to request access, correction or deletion; we will respond within 30 days.

Security

Detection requests travel over HTTPS, and our server sits behind Cloudflare. Payment processing is handled by PCI‑compliant vendors using encrypted (SSL) transactions. Account passwords, where they exist, are stored encrypted and are not visible to us. No system is perfectly secure; if a breach materially affects you we will notify you as soon as we reasonably can and describe the corrective action taken.

Children

The extension and website are not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided us with information, contact us and we will delete it.

Changes to This Policy

When we change this policy we post the new version here and update the “Last updated” date above; material changes are also surfaced in the extension. Changes apply to information collected after they take effect. If you object to a change within 20 days of posting, the change will not apply to information we already hold about you, though we may then be unable to keep providing the affected feature.

Questions

If you have any questions about this policy, or want to access, correct or delete information we hold, contact us at [email protected].