1. The website (checkoutleak.com)
- No cookies. The website sets no cookies of any kind.
- No third-party scripts. There are no analytics, advertising or tracking scripts. Our scripts, styles and fonts are served from checkoutleak.com itself; the fonts are self-hosted, not loaded from Google. The site’s security policy only allows scripts from our own domain.
- No browser storage. The website does not use local storage, session storage or similar browser storage.
- Waitlist form. Joining the waitlist sends your email address to app.checkoutleak.com without cookies, and nothing is saved in your browser. What we do with the address is in our privacy policy.
Our host, Vercel, processes standard request data (such as IP address, browser and requested page) to deliver the site and protect it from abuse.
2. Inside the Shopify app
The app runs inside Shopify admin, so Shopify’s own sign-in and session mechanisms apply. Shopify App Bridge gives the app a short-lived session token with each request; that is how the app knows which store you are signed in to. Shopify admin sets its own cookies, which are covered by Shopify’s privacy policy.
If Shopify has to send you through its standard sign-in redirect, Shopify’s app library may set a short-lived, strictly necessary cookie to secure that step. CheckoutLeak adds no analytics, advertising or tracking cookies to the app.
3. Storefront insights pixel (optional)
The storefront pixel is off until a merchant turns on storefront insights in the app. It is a Shopify web pixel: it runs in Shopify’s strict sandbox rather than on the store’s page itself, and it only fires where the shopper has allowed analytics through the store’s Shopify customer privacy settings, where consent is required. It is not used for marketing, and the data is never sold or shared.
It sets no cookies
To avoid counting the same thing twice, the pixel keeps two small entries in the shopper’s browser session storage. They stay in the browser, are never sent to us, and are cleared when the browser session ends.
| NAME | PURPOSE | DURATION |
|---|---|---|
cl_src | Remembers the kind of traffic source the visit came from (such as direct, search, social, email or paid), so later pages report the same source. | Browser session |
cl_sent | Remembers which steps were already counted in this session (the visit and each checkout step, using Shopify’s checkout reference), so a reload doesn’t count them again. | Browser session |
What it sends
Each event carries only the step (such as product view, add to cart or a checkout step), the device class (desktop, tablet or mobile), the traffic-source class, a product ID where relevant (up to 10 product IDs for a completed purchase), a cart-value band rather than an exact amount, and the type of checkout error a shopper saw. If that error was a rejected discount code, we store only a keyed hash of the code. Events are sent with the store’s domain and pixel key.
The pixel sends no visitor or client ID, no customer details and no page URLs. Our collector does not store IP addresses; like any web request, the request passes through our host, Vercel. Events are stored as daily counters for 90 days and deleted with the rest of the store’s data when the merchant uninstalls the app.
Merchants who turn on storefront insights should mention it in their store’s own privacy policy, alongside the store’s other analytics.
4. Changes and contact
If we change what we store in a browser, we will update this page and the date above first. Questions: privacy@checkoutleak.com.