Security and Data Use

Last updated: July 9, 2026

Default GradeMy scans use public pages only. GradeMy does not access checkout/customer data.

Default scan boundary

GradeMy reads public storefront pages and public metadata. Typical evidence includes page HTML, product detail pages, structured Product/Offer data, sitemap and robots signals, public policy links, visible product copy, image alt text, and contact/about visibility.

Data not collected by default

GradeMy does not collect or request passwords, payment data, checkout sessions, cart contents, customer accounts, private customer records, private orders, GA4 analytics, Merchant Center status, server logs, or private admin screens during a default public scan.

Optional read-only Shopify OAuth

When offered, Shopify OAuth is optional and intended for deeper catalog validation. The connection should use read-only permissions. GradeMy does not request write-admin permissions, does not modify products, and does not perform checkout or order actions.

Operational controls

Scans are bounded to product-readiness evaluation and should not be used for abusive crawling, access-control bypassing, or private data collection. GradeMy is designed to avoid checkout, cart, account, and write-action paths.

Security contact

Report concerns to matt@grademy.store.