Chapter 26: App Store Compliance

Shopify Requirements

Embedded App Mandate

As of late 2024, Shopify requires all new public apps to be embedded within the Shopify Admin. Standalone apps (opening in a separate browser tab) are no longer approved for the App Store.

AdPriority satisfies this requirement by rendering inside an App Bridge 4.1 iframe. The merchant never leaves the Shopify Admin to use AdPriority.

GDPR Webhooks

Three mandatory webhook endpoints must be implemented and functional at all times. Shopify tests these during the review process.

Implementation details for shop/redact:

SHOP DATA DELETION
==================

  Webhook received: shop/redact
         |
         v
  Verify HMAC signature
         |
         v
  Look up store by shop domain
         |
         v
  Mark store as is_active = false
         |
         v
  Schedule deletion job (30-day delay)
         |
         v
  After 30 days:
    DELETE FROM audit_logs WHERE store_id = ?
    DELETE FROM sync_logs WHERE store_id = ?
    DELETE FROM season_rules WHERE season_id IN (SELECT id FROM seasons WHERE store_id = ?)
    DELETE FROM seasons WHERE store_id = ?
    DELETE FROM rule_conditions WHERE rule_id IN (SELECT id FROM rules WHERE store_id = ?)
    DELETE FROM rules WHERE store_id = ?
    DELETE FROM products WHERE store_id = ?
    DELETE FROM subscriptions WHERE store_id = ?
    DELETE FROM stores WHERE id = ?
         |
         v
  Log deletion completion
         |
         v
  Return 200 OK

The 30-day grace period allows merchants who accidentally uninstall to reinstall without losing their configuration. After 30 days, all data is permanently and irrecoverably deleted.

Data Deletion on Uninstall

When a merchant uninstalls the app, the app/uninstalled webhook fires. AdPriority handles this by:

1. Cancelling any active subscription via the Billing API
2. Stopping all scheduled sync jobs for the store
3. Marking the store as is_active = false
4. Starting the 30-day data retention countdown
5. If the merchant reinstalls within 30 days, data is restored and the countdown is cancelled

Session Token Authentication

AdPriority uses Shopify session tokens (not cookies) for authentication. Session tokens are JWTs issued by App Bridge and signed with the app’s client secret.

Validation requirements (enforced on every API request):

If any check fails, the API returns 401 Unauthorized. The frontend (via App Bridge) automatically refreshes the session token and retries.

Polaris UI

Shopify mandates the use of Polaris for all UI components in embedded apps. Custom styling that overrides Polaris defaults may cause rejection.

Compliance checklist:

Google Requirements

OAuth Consent Screen

AdPriority uses Google OAuth to access the Google Sheets API (for supplemental feed management) and, for Pro tier merchants, the Google Ads API.

Consent screen configuration:

Google OAuth verification: For the Sheets API scope, Google requires app verification if the app will be used by more than 100 users. Submit for verification early in Phase 2 to avoid blocking the App Store launch.

API Quotas

Quota management strategy:

• Batch all Sheet writes into a single values.update call per sync (one API call for entire store)
• Monitor quota usage via the Google Cloud Console
• Implement exponential backoff on 429 responses
• Alert if daily quota usage exceeds 80%

Data Handling Policy

Google requires a clear statement of how user data accessed through their APIs is handled.

Privacy

No Customer PII Stored

AdPriority’s core design principle is that it never stores customer personally identifiable information. The app works exclusively with product data.

Data AdPriority DOES store:

Data AdPriority NEVER stores:

Encrypted Credentials

All OAuth tokens and API credentials are encrypted at rest using AES-256.

The encryption key is stored as an environment variable (ENCRYPTION_KEY) and is never committed to source control or written to logs.

Privacy Policy Summary

ADPRIORITY PRIVACY SUMMARY
===========================

  What we collect:
    - Product data (titles, types, tags, vendor, IDs)
    - Shop domain and merchant notification email
    - Priority scores and sync status

  What we DO NOT collect:
    - Customer personal information (names, emails, addresses)
    - Order data
    - Payment data
    - Browsing data

  How we use data:
    - Calculate priority scores for products
    - Sync custom labels to Google Merchant Center
    - Display dashboard and analytics

  Who we share data with:
    - Google Merchant Center (custom labels only, via Google Sheets)
    - No other third parties

  How long we keep data:
    - Active while app is installed
    - Deleted within 30 days of uninstall

  Your rights:
    - Export your data at any time (via GDPR data request)
    - Delete your data by uninstalling the app
    - Contact support@adpriority.com for any privacy questions

Compliance Checklist

Pre-Submission Verification