Privacy
These words have stood since 17 August 2026. The date moves when the words move and not when we deploy.
StorePrism reads public pages from Shopify storefronts and turns what it finds into answers about what a store runs, what it sells and what it earns. This page says what that means for you — whether you are a visitor who typed a domain in, a customer who pays us, or the owner of a store we describe.
Who we are
We publish as StorePrism, at storeprism.com. We have not published an incorporated entity or a postal address, and we would rather say that plainly than print one that is not true. Every request below reaches us at the address in contact, and we answer within 30 days.
What we hold about you
If you have never signed in, we hold nothing that identifies you. You can use every free tool on this site without an account, and we do not ask for one.
If you have an account, we hold:
- Your email address, because it is what an account is. It comes from the identity provider you signed in with.
- What you looked up and what it cost — a domain, a date and a price per lookup. This is what a bill is worked out from.
- What you were granted and what you paid — your plan, its history, and the record our payment provider sends us when a payment succeeds or is refunded.
- Any store domains you saved, because you asked us to remember them.
That is the whole list. There is no profile, no behavioural record and nothing bought from anybody.
The cookies we set
Four, and there is no fifth — you can check that in your browser's own cookie list. All four are strictly necessary: each one is the mechanism behind something you asked for, none of them measures you, and none carries a decision you could be asked to consent to. That is why this site shows you no cookie banner. If we ever set one that is not necessary, we will ask first.
| Cookie | What it is for | How long it lasts | Where it is sent |
|---|---|---|---|
storeprism_session | Keeps you signed in. It holds the encrypted tokens from our identity provider, when they expire, and — if you asked about a store before signing in — that one store domain, so you land back on it. No name, no address, and nothing a script on this site could read, because it is set httpOnly. | Until you sign out, or until the token behind it expires. | This site only. It is never sent to our API, which is another host. |
storeprism_identity | Holds the encrypted identity token that signing out hands back to our identity provider, so signing out here also ends the session the provider holds for you. Nothing reads it until you sign out. | Until you sign out, when it is deleted. | This site only. |
storeprism_auth | Ties a sign-in you have just started to the answer that comes back from the identity provider, so somebody else cannot finish it for you. It also holds where to send you afterwards, and the store domain you asked about if you arrived with one. | Ten minutes, and it is deleted the moment the sign-in ends. | This site only. |
storeprism_intent | Remembers the one store domain you asked about, so that after signing in and paying you land back on the answer you came for rather than on a dashboard. | Your browser session, and it is spent the first time it is read. | Only /billing. The pages that rank never see it at all. |
What we do not do
Each of these is checked by a test rather than asserted here, because a promise nobody can hold us to is not worth making.
- Your browser loads nothing from anybody else's servers — no advertising pixel, no font from a content network, no script that follows you anywhere. We count visits with cookieless analytics served from our own domain: your browser talks only to us, and we pass anonymous page-view events on to Plausible, our analytics processor, which sets no cookie, keeps no identifier that outlives the day, and does not store your IP address.
- We do not store your IP address. It is used, in memory, to work out whether one caller is asking too often, and it is written to no table.
- We count how many people opened a page on a given day. That count is a number per page per day — it carries no identity, and nothing in it can be traced back to a visitor.
- The record of what you looked up is yours, and it is never rewritten. It is what a bill is audited against, so entries are added and never edited or deleted.
- Your card details never reach us. Checkout happens on our payment provider's own pages, and what comes back to us is the fact that a payment succeeded, its amount and the address you gave them.
- Your password is not ours to hold. Signing in happens at our identity provider, and what this site keeps is an encrypted token, not a credential.
How long we keep it
Stated as what is true, rather than as a schedule we do not run. Nothing here is deleted automatically after a period, so we do not claim it is.
| What | How long |
|---|---|
| Your account — your email address, the id our identity provider knows you by, the two ids we file your account and your data under, and when the row was created and last changed. No name, no postal address, no card number. | While the account exists. Ask us and we erase it. |
| What you looked up and what it cost, and the record of what you were granted and paid for. | Kept. It is the record a bill or a refund is checked against. Most of it is filed against your account rather than against you — the exception is what our payment provider sends us when you pay, which names the address you gave them. |
| The readings we have taken from a store. | Kept, because a store's history cannot be reconstructed once it is gone. If you own the store and would rather we did not hold them, ask and we remove them. |
| The daily count of how many people opened a page. | Kept. There is nothing in it to erase. |
Who else is involved
Three, and each does one thing:
- Our identity provider holds your sign-in credentials. We never see your password.
- LemonSqueezy is the merchant of record for every purchase. Your card details are theirs and never ours; what reaches us is that a payment succeeded, what it was for and the address you gave them.
- Our hosting provider runs the servers this site and its API are served from.
Nobody buys data from us and we sell none. Nothing on this site is advertising-funded.
Asking us for your data, or to erase it
Write to [email protected] and ask for a copy of what we hold, a correction, or erasure. We answer within 30 days of establishing that the request is yours to make.
We check that first, and we check it every time. The mailbox is public and anybody can write to it claiming to be anybody, so a request acted on without that step would be a way of getting at somebody else's data rather than your own. Contact says exactly what the check is.
Erasure is a person doing it by hand rather than a button, and we would rather say so: there is no automated export or deletion endpoint. It is still a real offer, and 30 days is the window we hold ourselves to.
If we describe your store
We publish figures about stores whose owners never asked to be described, and we think that comes with obligations rather than only a disclaimer. If a page here is about your store you can ask us to correct what it says, to stop reading it, or to remove it entirely — and removal means it stays removed the next time somebody looks the domain up, not until then.
What our crawler does is the fastest route if you want us to stop reading the store at all; contact is where a correction or a removal goes. Neither needs an account.
When this page changes
The date at the top moves when the words do. We do not keep a published archive of previous versions, and we would rather say that than imply one exists.