RankNest ("the App", "we", "our", "us"), published by AppNest Studio, is a Shopify app that audits a merchant's own storefront for SEO defects, groups them by the template that causes them, and ranks them by the revenue of the pages they affect. This policy explains what data the App accesses, why, how long we keep it, and who it is shared with.
Contact / Data Protection: support@appnest.studio
1. Who the data belongs to
The App acts as a data processor on behalf of the installing merchant (the data controller). We process the merchant's Shopify store data solely to produce the SEO audit the merchant asked for.
2. What we access and why
| Scope | Why |
|---|---|
read_products |
Product URLs to seed the crawl, and vendor, category, barcode, SKU and metafield counts for the AI-readiness checks. Sitemaps omit noindexed and orphaned products, which are exactly what two of our checks look for. |
read_orders |
Revenue ranking only, and only on plans that include it. The orders/create webhook is reduced to a per-landing-page daily total the moment it arrives. No order ids, amounts per order, names, addresses, emails or any other field are read, logged or stored. |
These are the only two scopes the App requests. There is no write scope of any kind — the App cannot and does not change anything in the store. We request no read_customers, no read_all_orders, and no payment, checkout or fulfilment scopes.
The App also fetches the merchant's public storefront, the same pages a search engine reads. The address comes from the Shopify Admin API (the store's own primary domain) and never from a form, so there is no way to point the crawler at another site. Private and link-local network addresses are refused both before and after DNS resolution, redirects must stay on the same host, responses are size-capped and time-limited, and robots.txt is respected. The crawler never adds to a cart, never reaches checkout and never creates an order.
3. What we store
| Data | Stored? | Notes |
|---|---|---|
| Shopify session / access token | Yes | Required to call the Admin API. Encrypted at rest |
| Crawled page facts (path, title, meta description, heading counts, canonical, word count, structured-data types) | Yes | The audit itself. Public page content only |
| Findings (which check, which template, how many pages, example paths, your ignore reason) | Yes | Your worklist |
| Before/after checkpoints for a verified fix | Yes | The record that a fix worked |
| Orders per landing page per day (a count and a total) | Yes | 400 days. Aggregate only — see below |
| Search Console metrics per page per day (impressions, clicks, position) | Yes | 16 months, matching Google's own retention |
| Core Web Vitals and third-party script sizes per template | Yes | From public performance APIs and the crawled HTML |
| Google Search Console refresh token | Yes | Encrypted at rest (AES-256-GCM) with a rotatable key, never logged |
| Storefront password (password-protected stores only) | Yes | So the crawler can reach the storefront. Encrypted at rest, masked in the UI, deleted on uninstall |
| Alert email / Slack webhook URL | Yes | Where to notify you. The webhook is encrypted at rest |
| Order details, customer or payment data | No | Never read beyond the aggregate below |
The order aggregate, exactly
Each orders/create webhook is reduced, before anything touches the database, to:
(shop, landing path, date, order count, revenue)
The landing path is the path only — the query string is discarded first, because query strings routinely carry click and session identifiers. The date is the calendar day in the store's own timezone. Nothing else from the order is read: no order id, no order name, no line items, no addresses, no email, no customer name, no IP. Test and cancelled orders are skipped. This is pinned by an automated test, so a future change that started reading a buyer field would fail the build rather than ship.
On plans that do not include revenue ranking, the webhook is discarded and nothing is recorded at all.
Under Shopify's Protected Customer Data programme this is Level 1 (order data, no customer fields).
4. Data retention & deletion
- Audit data is retained while the App is installed, within the periods in the table above.
- On app uninstall and on the Shopify
shop/redactcompliance webhook, we delete all data for that store, and we revoke the Google Search Console grant. - We honour
customers/redactandcustomers/data_request. Because we hold no customer data, there is nothing to return or erase.
5. Google user data
Connecting Google Search Console is optional. When you connect it, the App uses Google's read-only webmasters.readonly scope to read impressions, clicks and average position for the property you select.
That data is used for exactly one purpose: ranking your own SEO findings by the revenue of the pages they affect. It is not shared with anyone, not sold, not used for advertising or profiling, not used to train any model, and not combined across merchants. RankNest's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting in Settings revokes the grant with Google, not merely our copy of the token. If Google cannot be reached at that moment, the App says so and tells you to remove it from your Google account's third-party access as well.
6. Sub-processors / third parties
| Who | What for |
|---|---|
| Railway | Hosting and the database |
| Google (Search Console, PageSpeed Insights / CrUX) | Read-only search and performance data |
| Resend | Sending alert and weekly summary emails (optional) |
| Sentry | Error reporting (optional; credentials and URLs are scrubbed before send) |
| Slack | Only if you configure a webhook |
We do not sell data, and we do not use merchant or buyer data for advertising.
7. Security
Data is encrypted in transit (TLS) and at rest by the hosting provider. Credentials we hold on your behalf — the Shopify access token, the Google refresh token, the Slack webhook and any storefront password — are additionally encrypted at the application layer with a rotatable key.
8. Changes
Material changes to this policy will be reflected here with an updated date. Continued use of the App after a change constitutes acceptance.