Is the Shop app safe?

Is the Shop app legit, and who is behind it?

Yes — Shop is Shopify's own product, and you can check that yourself. Its Apple App Store listing names Shopify Inc. as the developer and seller — checked on 1 August 2026; we did not check the Google Play listing. Shopify's Help Center describes Shop as a shopping destination and delivery tracking app available on iOS, Android, on the web, and through agentic shopping experiences, and Shopify runs the app's own help pages on the help.shop.app subdomain.

Knowing who built it is not the same as knowing it is safe to use — Shop and Shopify are two different products. Shopify does say it outright in that App Store listing — your info is safe with Shop, which meets strict PCI compliance standards — but that is marketing copy: none of the Shop channel, Shop Pay, security or consumer-privacy pages we read in July 2026 explains the mechanics behind it. So the rest of this answer is read off what those pages do commit to — where your card details sit, what a store can see, and what the Shop listing does not check.

What happens to your card and address details in Shop Pay?

Shop Pay is the saved-checkout half of the app, so it holds the sensitive details. Shopify publishes a Level 1 PCI DSS certification for its platform — that page states the certification for Shopify itself, without narrowing it to the Shop app on its own. On where those details sit, its Shop Pay help page says this:

Read it as written: a store gets your details only when you place an order, and the wording covers shipping and billing information. Shop's own help centre is more specific about the wallet itself — the email, addresses, card details and phone number it saves are, in its words, saved and securely encrypted. None of the pages we read — the Shop Pay help section, Shopify's security page and Shop's passkey help in July 2026, and Shop's own overview on 1 August 2026 — uses the word tokenization or explains how that encryption works.

Reaching those saved details takes a second factor, and it is not always asked for: returning to a store on the same device, Shop Pay completes the purchase without a passkey or SMS confirmation — worth knowing before you hand anyone an unlocked phone. Checking out with Shop Pay without the Shop app, a shopper verifies the purchase with a Shop passkey or a unique six-digit code received by text message or email, and a Shop passkey is face or fingerprint recognition, or a PIN.

What does the Shop app collect, and what can a store see?

Two different things, and the gap matters. Shopify's consumer privacy policy says it receives information about your use of, or interactions with, its apps and services whether or not you are logged in to Shopify, including device identifiers, cookie IDs, the browser you use and your network connection. A store sees a narrower slice, and only its own:

• What Shopify receives. Your activity across Shop and its other consumer services, plus the technical identifiers above.
• What a store gets. Personal data about your interactions on Shop and other Shopify consumer services. The policy we read in July 2026 describes that access in one general sentence rather than a list of categories — the browsing, search and cart detail it does spell out is what Shopify receives about your activity on a store's site, not what the store is handed.
• What stays out of reach. The products you save inside Shop, and the notifications Shop sends you, are not something a store can look up or configure.

How do you limit what Shop keeps, or delete your account?

This is the part you can act on today, and most of it is inside the app: Shop's help pages tell you to tap Data and privacy and adjust your settings. The consumer privacy policy lists the rights behind them:

• Ask for a copy. A right to request access to your personal data.
• Ask for it to be deleted. A separate right to delete personal data about you.
• Stop the ad targeting. A right to direct Shopify not to share your personal data with third parties for targeted advertising, and to opt out of its use of that data to show you marketing based on your interaction with different merchants.

Shop's own help page on managing your account and data says deleting the account removes your email address, phone number and other data from Shop, and that you lose Shop Pay, Shop Pay Installments, delivery tracking and any Shop Cash you have earned — but the same page says deletion does not erase personal data from the stores you bought from. The switch is in the app: Settings > Data and privacy > Delete account.

Does Shopify check the stores you see inside the Shop app?

Not in the way most shoppers assume. Listing is automatic rather than curated: Shopify says that if a store meets the eligibility requirements set out in the Shop Merchant Guidelines, then the store and its products are automatically listed in Shop. Shopify listed eight groups of requirement on 1 August 2026, and says the list can change without notice; three of them are:

• an active Starter plan or higher;
• Shopify Payments activated on the store;
• a chargeback rate of less than 1% in the last six months.

Some goods cannot be sold through the channel at all — Shopify's prohibited-products page for Shop names age-restricted items such as alcohol, tobacco and gambling, plus cannabis, weapons, among examples it says are not the full list. None of the Shop pages we read in July 2026 — the Shop channel help section, its eligibility pages, Shopify's Shop product page and its post on trust badges — calls Shop a marketplace or describes the stores in it as verified, curated or vetted; where marketplace does appear on the product page it is a navigation label and a line saying Shop has no marketplace fees, and verified there counts shoppers, not stores.

So the three requirements above cover a store's plan, payment setup and account hygiene, not whether the seller is honest — a separate question, answered in whether Shopify verifies sellers at all.

The full merchant-side bar is in our guide to the Shop channel.

What protects you if a Shop app order goes wrong?

Less than the names suggest. Shopify Protect is the one shoppers misread: Shopify describes it as chargeback protection from fraud for Shopify merchants. It defends the seller, not the buyer, against fraudulent and unrecognised chargebacks, and Shopify states plainly that it does not protect against the chargeback types a disappointed shopper would raise — an item not received, defective, damaged, or not as described.

Shop Promise does point at you, but it is narrow. On eligible Shop Promise orders Shopify includes a limited guarantee: if the first attempt to deliver lands later than the date Shop Promise gave, the customer could be eligible for $5.00 USD in Shop Cash, which can only be spent in the Shop app. Shopify Protect requires the merchant to be in the United States with a US Shopify Payments account, Shop Promise is a United States program too, and as of July 2026 neither has widened. Neither is a general refund route either — that runs through the store's own policy and your card issuer, the subject of whether Shopify offers buyer protection.