You approve every write.
Transparent by default.

Access model

Read-only by default. You approve every write.

Legible installs with the minimum read scopes required to run the six-pillar audit. Write access is a separate, optional scope you grant only when you choose to publish a change. The complete list:

read_products gives us access to product titles, descriptions, variants, metafields, and image URLs — the data the six core pillars score. read_locales and read_translations give us access to your enabled markets and translated product strings for the multilingual audit. read_orders is used only to measure the before/after sales impact of your catalog optimizations, and we read it in a strictly data-minimized way: only an order's identifier, date, line-item quantity and product, and total amount — never a customer name, email, phone, or address. The raw order is discarded immediately; we keep only non-personal per-product daily sales aggregates (units and revenue), which carry no customer linkage. These four read scopes are requested at install.

write_products is an optional scope. It is not requested at install — Shopify prompts you to grant it the first time you click Apply on a specific suggestion. It is used only to publish merchant-approved product content: a description rewrite (via productUpdate) or a structured product metafield value (via metafieldsSet). No other product field, and no non-product resource, is ever written, and every applied change is independently undoable for 30 days. A server-side scope guard verifies the live granted scopes before every write and refuses the operation if write access has not been granted. You can run the full audit forever without ever granting write access.

Customer data, payment data, fulfilment data, and staff data are never accessed — Legible does not request the read_customers, read_payment_mandate, read_files, or other scopes. Order data is read only in the data-minimized form described above (no customer fields, non-personal aggregates only) and never to build any customer profile.

Data flow

What data leaves Shopify.

Some product data is sent to third-party AI services to produce scores. Here is the complete list of what moves and where it goes:

Infrastructure

Where your data lives.

The Legible application runs on Fly.io, deployed to the Paris (cdg) region. Catalog data — product scores, metafield coverage, duplicate clusters, and audit history — is stored in a SQLite database on an encrypted persistent volume attached to the Fly.io application. The encryption key is managed by Fly.io's volume encryption layer.

All traffic between your browser, the Legible app, and Shopify's API is encrypted with TLS 1.3. Connections that negotiate below TLS 1.2 are rejected. There is no unencrypted HTTP access to any Legible endpoint.

The marketing site (this page) is served from Vercel's edge network via Cloudflare. No catalog data is processed or stored on the marketing site infrastructure.

Data retention

How long we keep your data.

Catalog data — product scores, embeddings, audit history, metafield coverage snapshots, and the non-personal per-product sales aggregates derived from order data — is retained for the duration of your active subscription plus 30 days after uninstall. The 30-day window lets you reinstall without losing your history. After 30 days, all of this data for your shop is permanently deleted from Legible's database.

Legible honors all three GDPR mandatory webhooks from Shopify:

• customers/data_request — Legible stores no customer PII. We respond with an empty dataset within 30 days.
• customers/redact — No customer records to redact. Confirmed immediately.
• shop/redact — All catalog data for the shop is permanently deleted within 30 days of the webhook being received, per Section 8 of the Privacy Policy and Shopify API Terms §6.2.3.

Session tokens and OAuth credentials are deleted immediately upon uninstall. No re-authentication is possible after uninstall without going through the full install flow again.

Offboarding

What happens when you uninstall.

When you uninstall Legible from the Shopify admin, the following happens in sequence:

1. Your OAuth session token is revoked and deleted immediately.
2. All active sync jobs for your store are cancelled.
3. Your catalog data remains accessible in read-only mode for 30 days so you can export your last report.
4. After 30 days, all catalog data — product scores, embeddings, duplicate clusters, audit history — is permanently deleted.
5. Billing stops immediately per Shopify's app billing policy. Refunds for unused days are processed per Shopify's standard policy.

There is no hidden retention. Once the 30-day window closes, your data is gone and cannot be recovered.

Sub-processors

Every service that touches your data.

The following third-party services process data on behalf of Legible. This list is complete as of the audit date below.

Last audited 2026-05-19. Sub-processor list updated when services are added or removed. Material changes notified via the Legible changelog.

Write safety

How writes are guarded.

The optional write_products scope is used only to publish merchant-approved product content — a description rewrite or a structured product metafield value — that you have explicitly approved by clicking Apply on a specific suggestion. No other product field, and no non-product resource, is ever written. Every write must pass the four safety rails below before it lands in your store.

1. Hallucination scan. A regex-based scan rejects rewrites that introduce unsupported regulatory claims (e.g. organic, FDA, certified, ISO, gluten-free, cruelty-free, vegan, fair-trade, hypoallergenic, clinically-proven, cures/treats/prevents), numeric claims with units (currency, dimensions, weight, capacity, percentages), or brand names not present in the source description. A rewrite that introduces any unsupported claim is rejected before persistence — you never see the bad suggestion in your dashboard.
2. Prompt-injection guard. Product descriptions can contain adversarial instructions ("ignore previous instructions and..."). A versioned prompt-injection test battery and system-prompt hardening defend against these attempts. Any rewrite that contains hallucinated regulatory, numeric, or brand claims resulting from a successful injection is caught by the hallucination scan and rejected before persistence.
3. Per-plan daily cap. A rolling 24-hour window caps successful writes per shop: Starter 500, Pro 2,000, Business 10,000. Undoing a previous write does not consume the cap. The cap is enforced server-side before the Shopify mutation fires, so a runaway client cannot bypass it.
4. 30-day undo with conflict guard. Every applied write logs a row to an audit table that allows you to undo for 30 days. Before performing an undo, Legible reads the current value of the affected field from Shopify and compares it to what we wrote. If they differ — meaning another tool or you edited that field in Shopify between our apply and your undo — we refuse to silently overwrite the foreign edit and present a three-way diff so you can resolve manually.

Every audit row is tenant-isolated by Shopify shop ID. A forged identifier from a client cannot retrieve another shop's records.