Privacy policy
Last updated: September 3, 2026 · Checkout Firewall
Checkout Firewall is a public Shopify app that helps merchants stop card-testing attacks before they reach a payment processor. This policy describes what we process and why. Merchants remain the data controller for their store’s customer data; we act as a processor for the purposes below.
What we process
We process checkout identity needed to match merchant lists and hashed reputation: email, phone, shipping or billing address, postal code, and Shopify customer id when present. We never receive payment card numbers, CVV, or magnetic stripe data.
How identifiers are stored
Canonical forms are HMAC-hashed before they enter shared reputation tables. One merchant cannot see another merchant’s customers or the raw values another shop reported. Hashing reduces accidental cross-store leakage; it is not anonymity and does not replace GDPR, UK GDPR, or CPRA obligations.
Shop-local data
Blacklists, whitelists, fraud reports, activity logs, and attack observations stay scoped to the installing shop. Display labels are masked so the merchant can recognize what they entered. Cross-store UI never exposes another shop’s PII.
Purpose
Processing is limited to checkout fraud prevention:
- Compiling Cart & Checkout Validation Function rules
- Logging merchant-visible decisions and activity
- Detecting card-testing bursts and correlating hot identities
- Operating a hashed cross-store reputation set
- Optional merchant alert email for attack signals
- Merchant support and feature requests, including an optional follow-up email only when the merchant allows it
Retention and deletion
Observation and decision records are retained up to 180 days unless a merchant uninstalls or Shopify sends a mandatory redact webhook sooner. Shop uninstall and shop/redact delete that shop’s local data. customers/redact deletes matching hashed observations and reports for that shop. customers/data_request collects matching checkout observations, decision logs, reports, and list entries for the merchant (emailed when an alert destination is configured) so they can fulfill the request.
Buyer impact
In Monitor mode the Function never blocks checkout. In Balanced or Aggressive, high-confidence matches can stop checkout. Merchants can whitelist an identifier or mark a report as a false positive.
Subprocessors and hosting
The app runs on infrastructure operated by the app developer (currently hosted for shopfrauddetection.com). Optional attack alerts may be sent through Amazon SES when the merchant enables email alerts. Shopify processes checkout and Admin API traffic under Shopify’s own terms.
Contact
Privacy questions: [email protected]. See also our contact page and terms of service.