Privacy and security

The operational picture: what is collected, where it lives, who can reach it, and what happens when you point an AI assistant at it. The legal document is the privacy policy; this page is what the policy means in practice.

Never collected

These are design decisions in the collection code, not settings:

Form field values. Field names, input types and timings only. Password inputs report under the generic key (password). There is no flag that turns value capture on, because the code to capture values does not exist.
Payment details. The pixel observes that a payment step completed. It never sees what was entered.
Customer names, emails and addresses. The behavioural schema has no column for them, and nothing is joined to Shopify customer records.
IP addresses. Country is resolved at the edge and the IP is discarded. This is why country data cannot be backfilled before 31 July 2026.
Session video. Behaviour is reconstructed from structured events. There is no recording of the screen.

Click Context integrates with Shopify's Customer Privacy API on every plan, including Free. A visitor who declines analytics consent is not tracked. This is one of the two reasons the order count here is a lower bound against Shopify's own reporting.

Because consent is enforced at collection rather than at query time, declining leaves no record to delete later.

Visitors and sessions

A visitor id is a first-party pseudonymous identifier whose only job is to tell returning visitors from new ones. A session groups one visit's events. Neither resolves to a person.

Where the data lives

Database: Neon, EU region.
Application: Vercel.
Operator: Vcommerce Tech Oy, Finland.

Retention is plan-based, with raw events expiring before aggregates. See Plans and limits for the figures and the privacy policy for deletion rights and sub-processors.

Authentication

OAuth: Claude and ChatGPT. The client discovers the endpoints and registers itself; a single-use six-digit code, valid ten minutes, proves the person connecting owns the store.
API key: Config-file clients. Sent as a bearer token, shown once, stored only as a SHA-256 hash. Generating a new key invalidates the old one.
Store identity: Resolved from the credential on every request. A token can only ever read the store it was issued for.

Uninstalling the app ends access immediately, whatever credentials are still sitting in a config file somewhere.

What your AI provider sees

This is the part worth thinking about

Tool results are returned to whichever assistant you connected, and they become part of that conversation. Your data therefore transits your AI provider under theirterms — Anthropic's for Claude, OpenAI's for ChatGPT — not ours.

Both providers state that API and connector traffic is not used to train their models by default. Verify that against your own contract if it matters to you, because it is their commitment to make and not ours.

What limits the exposure is what is in the data at all. There are no customer identifiers, no field values and no payment details to leak into a conversation, because none of it is ever collected.

Click Context does not send your data to any model of its own, with one exception: session summaries on Growth and above are generated by an LLM over your stored events, nightly, inside our infrastructure.

What the tools can change

The server is read-only over your store, with one narrow exception: custom event rules. An assistant with a valid credential can create and delete tracking rules, which changes what your storefront records going forward.

It cannot edit products, prices, inventory, themes, orders or customers. It cannot place, refund or cancel anything. The Shopify scopes the app requests do not permit it.

Effect on your storefront

The tracker is a theme app embed that loads as a normal asset. It does not block rendering, and it is what measures your Core Web Vitals rather than something that degrades them. Switching the embed off in the theme editor stops collection immediately, with no uninstall required.