Privacy

In effect 25 August 2026

JourneyLens is an app for Shopify stores. It records what visitors do on a merchant’s storefront so the merchant can see why people leave without buying. This page explains exactly what it collects, what it deliberately does not, how long anything is kept and who else sees it.

JourneyLens is operated by the developer of JourneyLens, contactable at journeylensapp@gmail.com.

The agreement you accept when you install JourneyLens, including the data processing terms that cover your visitors’ data, is on the terms page.

Who this covers

Two different people. Merchants, who install JourneyLens on their Shopify store, and visitors to those stores, whose behaviour the app records on the merchant’s behalf.

For visitor data the merchant is the controller and JourneyLens is the processor: we hold it only to show it back to that merchant, and we act on their instructions. For the merchant’s own account, session and support data we are the controller.

What the pixel collects from store visitors

JourneyLens installs a Shopify web pixel that runs in strict mode. Shopify controls the events available according to consent and approved permissions. JourneyLens keeps only the event fields used for its reports; customer contact, address and marketing fields are excluded from stored events.

For each event the pixel sends us:

  • An event id and a sequence number.
  • The store’s domain.
  • A visitor id supplied by Shopify. It identifies a browser so that separate actions can be joined into one visit. It is not a name and cannot be resolved to a person by us.
  • The name of the event, such as viewing a product or starting checkout.
  • When it happened.
  • The page address, with query strings and fragments removed and checkout, account and order paths reduced to their page category.
  • Selected product titles, prices, cart contents, checkout totals and currency, and checkout error categories. Raw search input, custom line properties and free-text checkout errors are not retained.
  • On a page view: the name of the website that linked to it (its host name only, never the full address), the utm_source, utm_medium and utm_campaign tags if the link carried them, which ad network’s click id was present (never its value), whether the device is a phone, tablet or computer, and whether the browser identified itself as automated. Campaign tags that look like an email address or a long number are discarded.
  • In checkout, the shipping cost and item subtotal the visitor was shown.
  • On a completed order, the order id. This is the only value we hold that a merchant can trace back to a named customer, using their own Shopify admin. It is kept because a deletion request has to have something to match on.

Shopify sends more than that, and we throw the rest away before anything is written down. A checkout event arrives carrying billing and shipping address fields, a customer id, and marketing consent flags; none of them are used by anything in JourneyLens, so none of them are stored. What survives is the list above.

The pixel declares a single purpose, analytics, and explicitly declares that it does not sell or share data. Shopify only loads it for visitors whose consent covers that purpose. Merchants remain responsible for their own storefront consent banner and privacy notice.

What we read from the Shopify Admin API

JourneyLens requests three permissions and no others:

  • Permission to create and update its own web pixel.
  • Permission to receive the customer events described above.
  • Permission to read products. It is used in two places. The store review reads the handful of products visitors already abandoned. The store setup check on the app’s Home page reads the title, a short description excerpt, whether there is an image and whether anything is in stock for the 25 most recently updated active products. The setup check is shown only to the merchant, is not stored, and is never sent to the AI provider.

We also read a small set of store settings for the review and the setup check: currency, time zone, tax settings, how many countries the store ships to, and which accelerated checkout methods are switched on.

We do not request access to your orders or your customer records, and we cannot read them. That is a deliberate limit.

What we collect from merchants

  • A Shopify session record, which includes the store domain, an access token, and the first name, last name and email address of the staff member Shopify supplies with it.
  • Any message you send us for support.
  • For the weekly summary, the store owner’s email address and the store name, read from Shopify each time the summary is sent and not stored. Whether the summary is on, and when it was last sent.
  • Ordinary server logs, which may include IP addresses, kept for operating and securing the service.

The store review, and Anthropic PBC

JourneyLens includes an optional store review. It runs when a merchant presses the button, and once a week when the weekly summary is prepared, never more than once a day. When it runs, we send a summary to Anthropic PBC in the United States, which operates the Claude model that writes the review.

What is sent:

  • Counts: how many visits there were, how many ended in a purchase, how many stopped at each stage and checkout step, how many hit each type of checkout error, and visits by source and by kind of device.
  • The store settings listed above, and the titles, handles and description text of the products visitors abandoned.

What is not sent:

  • No visitor ids, and nothing identifying any individual.
  • No orders and no customer records.
  • No monetary amounts. They are withheld from the model on purpose.

Anthropic PBC acts as our processor. Under Anthropic's commercial terms, inputs and outputs sent through its API are not used to train its models. If you would rather this never ran for your store, do not press the button and turn the weekly summary off; nothing else in JourneyLens uses it.

Who else we use

  • Railway: hosting for the application.
  • Supabase: the database, hosted in the Asia Pacific (Seoul) region.
  • Anthropic PBC (the United States): the store review only, as described above.
  • Resend (United States): sends the weekly summary email. It receives the store owner’s email address and the summary itself, which contains counts, store settings and product titles, and nothing that identifies a visitor.

Where data moves between countries, it does so under the standard contractual clauses our providers offer. We will tell merchants before adding another processor.

What we do not do

  • We do not sell or share personal information.
  • We do not use it for advertising, and we do not build profiles.
  • We do not compare one store against another, and we never show one merchant’s data to another.
  • We do not use any of it to train or fine-tune a machine learning model, our own or anyone else’s.

How long we keep things

Not one period for everything, because that would not be true:

  • Visitor events and the visit summaries built from them is deleted automatically 90 days after they happened.
  • Store reviews: kept until you uninstall, so you can read the last one.
  • Session records: kept until you uninstall.
  • A note that a data request arrived: the order numbers it named and whether we have answered it, kept until you uninstall. It holds no shopper data of its own; the answer is rebuilt from the events when we send it.
  • Server logs: kept for a short operational period by our hosting provider.

When you uninstall JourneyLens, every event, visit summary and store review for your shop is deleted, and so is your session. Shopify also sends us a shop redaction request 48 hours later, and we run the same deletion again as a backstop.

Rights, requests and deletion

Depending on where you live you may have the right to see what we hold about you, correct it, delete it, or object to how it is used. Write to journeylensapp@gmail.com and we will answer within 30 days.

For store visitors, requests go through the merchant, because they are the controller and the only party who can identify the person. Shopify passes those requests to us automatically:

  • A customer data request: we record the request and, within the 30 days Shopify allows, send the merchant every visit record belonging to the visitor behind the orders named, so they can forward it to the shopper.
  • A customer redaction request: we identify the visitor behind the orders named and delete their whole recorded journey, not only the events carrying an order number, without being asked twice.
  • A shop redaction request: we delete everything for that store.

Security

Data is encrypted in transit. Each store’s data is separated by its shop domain and is only ever served to that store’s authenticated admin session. Access tokens are stored in the database and never exposed to the browser. If we ever suffer a breach affecting merchant data we will notify Shopify and affected merchants without undue delay.

Children

JourneyLens is a business tool and is not directed at children. We do not knowingly collect anything from a child.

Automated decisions

The store review is written by a language model, but it makes no decision about any individual. It reads counts and store settings and writes advice for the merchant, who decides what to do.

Changes

If this policy changes we will update the date at the top, and for anything material we will tell merchants inside the app before it takes effect.