- Short answer
- An app gets whole classes of store data, not single records — a public app sees name, address, phone or email only after Shopify approves it.
- Checking an installed app
- Activity and permissions currently covers third-party apps only, so a Shopify-made app shows nothing there.
- Approval gate
- For public apps, adding the scope is not enough: unapproved fields come back redacted on live stores.
- Narrowing an install
- Only optional scopes are yours to revoke; required scopes change on the developer's side alone.
- After uninstall
- For App Store apps, Shopify sends a shop/redact webhook 48 hours later; the erasing happens in the developer's system.
- Custom apps
- Two official pages disagree: the developer table says Level 2 is always available, About apps requires the Grow plan.
- Web pixels
- Since December 10, 2025 unapproved pixel scopes return null PII fields on storefront, checkout and customer accounts.
- Scope
- Shopify's own App Store, custom-app and developer documentation, read August 31, 2026; vendor practice is not audited here.
What the app permission screen actually grants
An app granted access to orders can read the order table, not the three orders you had in mind. Access is granted while the app is being authorized — Shopify's developer documentation puts the timing plainly: "All apps need to request access to specific store data during the app authorization process."
The install screen sorts the app's request into two categories. "View personal data" covers the types of personal data the app can view, such as customers, the store owner and blog contributors. "View and edit store data" covers the areas of your store the app can view and edit, such as customers, products, orders, discounts, gift cards, marketing, store analytics and the Online Store.
Read the "View and edit store data" category carefully, because any permission to write a resource includes permission to read it — Shopify tells developers to request a write scope only when the app needs both. And note what this screen is not about: it describes an app, not a person. Staff and collaborator access to your admin is a separate system with its own rules.
Why name, address, phone and email sit behind a stricter tier
By default an app sees none of those fields: "By default, apps don't have access to any protected customer data." Shopify's protected customer data requirements put them in a tier of their own, described at Level 2 as "Customer data including name, address, phone, or email fields".
For a public app, adding the matching scope is not what opens that tier. A developer "can add the relevant scopes to your app, but the API won't return data from non-development stores until your app is configured and approved for protected customer data use", and once it is approved, "Responses will include only approved fields, and unapproved fields will be redacted." So an installed app can hold the scope and still receive nothing usable in those fields.
These requirements reflect the minimum acceptable handling of protected customer data and help apps support merchants with increasingly strict privacy and security requirements.
Across app types, Shopify's protected customer data table gives Level 2 as "Requires review" for a public app, "Always available" for a custom app and "Varies by plan" for an admin created custom app.
On custom apps the two official pages do not line up, so read both. Against that "Always available", Shopify's About apps page states that to access Custom Level 2 PII apps your store must be on the Grow plan or higher, and that if you sign up for or downgrade your plan to the Basic plan, then you won't have access to Custom Level 2 Personally Identifiable Information apps.
Since December 10, 2025 the same policy has carried a separate restriction for web pixel extensions: where an app is not approved for a given scope, the corresponding fields in the pixel event are set to null, and enforcement applies on all web pixel surfaces — storefront, checkout, and customer accounts. That is a different mechanism from the redaction above, and it is written for developers: among the Shopify pages we read on August 31, 2026, none on help.shopify.com mirrors the web pixel rule for merchants.
Can you narrow what an installed app can see?
Only one of the three levers narrows an installed app without the developer: the scopes an app declares as optional. Scopes it configures as required move on the developer's side, and the third lever, removing the app altogether, is yours too — but it ends the app rather than narrowing it.
| Lever | Who can change it | What it changes |
|---|---|---|
| Optional scopes | You | Merchants can grant or decline them, and can revoke ones they've granted. |
| Required scopes | The app's developer | Scopes configured in the app's scopes field can't be revoked dynamically; if the developer reduces them, you aren't prompted and the app loses that access when you next open the app. |
| Uninstalling | You | Ends the app's API access; some apps leave code in your theme that isn't removed automatically, and the copy already sitting in the developer's system is a separate question. |
For an app you already have, start with its Activity and permissions section, which shows "which areas of your store the app can view or edit, along with the date of the app's most recent activity in each area" — apps made by Shopify currently aren't tracked there.
Among the Shopify pages we read on August 31, 2026, none describes a way for a merchant to narrow a required scope on an app that is already installed. The routes the documentation gives are the developer's own scope configuration and uninstalling, which is why the install screen is worth reading before you click Install rather than after.
What happens to your customer data after you uninstall
Removing an app ends its access, which is a different thing from erasing what it already holds. Shopify's compliance documentation for App Store apps describes the signal it sends instead: "48 hours after a store owner uninstalls your app, Shopify sends a payload on the shop/redact topic." On receiving it the developer can erase data for that store from their database.
What happens when a customer asks you to delete their data is a separate obligation, and it is covered on our page on Shopify and customer data deletion requests.
How to tell whether an app is asking for too much
The test takes three minutes and belongs before the install, because afterwards only two levers are left — the optional scopes, and removing the app.
- Match each category to the job. Expand both categories and ask what the app actually does — a single-purpose app rarely needs several classes of store data at once.
- Open the Privacy Policy. The install screen links to it, and it is the one document there written by the developer rather than by Shopify.
This article was written entirely by AI under human editorial direction. The editor sets the topic and structure, runs multi-stage validation on facts, links, and interactive elements, and verifies the output is useful from a business perspective. All claims are checked against official Shopify sources. Details may change — always confirm critical data at shopify.com.
Editorial Policy