Security
What the app is allowed to touch
Access is limited to products, inventory and locations. Orders, customers, payouts, discounts and themes are outside the requested scopes: the app could not read them even if it tried.
Writes go only into the destination store of a connection you activated, and only into the fields listed in the help page. The source store is read-only for the app.
Nothing is deleted
There is no delete operation anywhere in the sync. Extra products, variants, images or metafields in the destination store are reported as differences and left alone. This is a property of the code, not a setting that could be flipped by mistake.
How access is stored
Each store's access token is encrypted with its own key, and that key is stored wrapped by a master key that exists only in the running service's environment - never in the database, never in the repository, never in logs.
Every request from Shopify is verified by signature before it is processed. Requests that fail verification are rejected without touching your data.
Two approvals before any write
A new connection reads and compares but writes nothing. Writes require two deliberate actions from the receiving store, and the app records both. Until then the write journal for that connection is empty - and that is verifiable, because every write the app performs is journalled with what it expected to produce.
Runaway protection
If a connection suddenly tries to write far more than its normal volume, it pauses itself and reports why. A bad edit upstream, or a bug on our side, cannot quietly rewrite a whole catalogue.
When you uninstall
Writes stop immediately, the stored access token is invalidated, and your store's data is erased within the period stated in the privacy policy. Products already synced stay in your store: they are yours, and removing them would be a deletion the app never performs.
Reporting a problem
Security issues: support@storetwin.app. Write in plain terms what you saw; we answer from the same journal the app shows you.