Shop app

Is the Shop app safe?

Yes, and it is one of the better choices for paying small online stores. Shop Pay keeps your card on Shopify's systems, which are certified to the card industry's highest security level, and stores never see the full number. What you give up is privacy: Shopify sees what you browse and buy across the stores built on it, and if you connect your inbox, Shop reads order emails from other retailers too. We found no privacy fine against the app. We score it 61/100, above PayPal (55) and Amazon (54).

What happens when you connect your email

Order tracking is Shop's main feature, and it works in two ways. Orders from Shopify stores, or paid with Shop Pay, appear automatically when the email address matches your Shop account. Shopify's help pages say Shop does not open your inbox for those.

For other stores, Shop asks you to connect a Gmail or Outlook account, and then scans the inbox for order and shipping emails. This is optional, and you can add tracking numbers by hand instead. Shopify's privacy policy, updated 2 March 2026, says it receives information from connected inboxes and does not use it for advertising or marketing. You can disconnect an inbox at any time from the Connections screen in your account.

Inbox access is still a lot to grant a shopping app. A connected account holds far more than receipts, and you are relying on Shopify's word about what it reads. If you only shop on Shopify stores, you do not need it.

The app now offers other connections too: a Meta sign-in token when you use Shop inside Instagram or Facebook, Shop Minis, AI shopping agents, and in the US, your Amazon Prime account. Each is a further party with access to your Shop data, and each can be removed in the same Connections screen.

How much Shopify knows about you

Shop's Apple privacy label has no "Data Used to Track You" section, which puts it ahead of Walmart and Temu. It still links a long list to your identity, including precise location, purchase history, payment info, address, phone number, search history and "emails or text messages".

The bigger picture is in Shopify's consumer privacy policy. Shopify collects your activity on merchants' stores, including what you browse, place in your cart and buy, "whether or not you are logged in to Shopify". It may give data to third-party advertising companies, which it says may count as "sharing" or "targeted advertising" under some privacy laws, and it offers an opt-out.

That cross-store view is the subject of a US lawsuit. Brandon Briskin, a California shopper, alleges that Shopify placed tracking cookies on his phone during a purchase and built consumer profiles it shared with merchants and others, without telling him. A lower court dismissed the case on jurisdiction grounds, but the Ninth Circuit, sitting en banc, revived it on 21 April 2025. Back in the federal court in San Francisco, Judge Phyllis Hamilton refused on 30 July 2026 to dismiss the amended complaint, so the case goes on. These are allegations, and no court has ruled on whether they are true.

Shopify has also dealt with EU consumer regulators. After complaints about Shopify-hosted web stores making fake offers, selling counterfeits and hiding their contact details, it agreed in 2022 to take down stores that national authorities report and to push merchants to show company details. That was a set of commitments, not a fine.

Shop Pay and account security

Shop Pay saves up to 10 cards and 20 addresses. Cards are encrypted and held by Shop Pay, not by each store, and your billing and shipping details go to a store only after you order. Shopify says it is certified Level 1 PCI DSS. Once your email and phone are verified, you can sign in with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary instead of codes.

Shopify's worst known incident was an insider case. In September 2020 it said two rogue members of its support team had taken customer transaction records from fewer than 200 merchants' stores: names, emails, addresses and order details, but no full card numbers. Shopify fired them and referred the case to the FBI.

One design choice deserves a warning. A Shop Pay account is created whenever you enter your phone number at a checkout and save your details, and Shopify's own help page says this is easy to forget. If you get a Shop Pay verification code you did not request, someone may be trying to use your number, so do not share the code.

How to use Shop more safely

1. Skip the inbox connection unless you need tracking for non-Shopify stores, and disconnect it when you stop using it.
2. Opt out of targeted advertising using the link in Shopify's consumer privacy policy.
3. Set up a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary once your email and phone are verified.
4. Before buying from an unknown store, check its contact details and return policy, and pay with Shop Pay or a card.

How we scored it

Regulatory record (85) and security (66) are Shop's strongest factors: no fines or orders (the 2022 EU consumer commitments cover Shopify-hosted stores, not the app), card storage to PCI DSS Level 1 and a single small insider incident in 2020. Privacy (50) is the weakest, because Shopify follows your shopping across its merchants and the app can read a connected inbox.