Workflow Transactional EmailWorkflow Transactional Email

Permissions: what the app can read from your store

This app is built so that it needs as little of your store data as possible. This page says exactly what it can read or do, when, and how you take that back.

Nothing at install

When you install the app, Shopify asks you for no access scopes. The app cannot read your products, orders, customers or anything else in your store. Customer data reaches an email only because you pass it in from Shopify Flow, through the step's fields and the Variables (JSON) field. Flow reads your store data; you decide what to hand over.

That has not changed. Everything below is optional and off until you switch it on.

The optional permissions

Two features need more. Attaching the file that a metafield of the order or customer holds, for example the invoice PDF another app saved on the order (see Attach a file from an order or customer metafield): Shopify only lets an app read a metafield with the permission for the resource it sits on, and only lets it turn the file reference into the file with the files permission. And the discount code block set to create a unique code for every email (see Content blocks: product, discount, countdown, tracking and more): creating a code discount in your store needs the discounts permission.

Permission Shopify scope What the app does with it
Orders read_orders Reads the one metafield named in your layout, on the one order the Flow step is about. Orders of the last 60 days.
Customers read_customers The same, on the customer the Flow step is about.
Files read_files Resolves the file a metafield points to: its download link, nothing else in your Files.
Discounts write_discounts Creates a single-use code discount when an email with a "create a unique code" block is sent, with the value, validity and minimum you set in the block. It never reads, changes or deletes other discounts.

The app never reads or creates anything on its own. It acts only while it sends an email whose layout asks for it: that metafield on that resource and the file it points to, or that one discount code. It does not list your orders or customers, does not read names, addresses, emails or line items, and stores none of what it reads: the file is downloaded for that send and attached; the created code is kept with the send in History so a resend can show it.

How you grant one

You never grant a permission on a settings page by accident. The first time you pick an order or customer metafield in the attachment picker, or switch a discount block to creating codes, the app explains which permission it needs and offers Grant access. Shopify then shows its own consent dialog, listing the scopes; nothing is granted until you confirm it there.

Granting a permission is per store and needs a staff account that may change app permissions. If your account cannot, Shopify refuses and the app tells you to ask the store owner.

How you take it back

Open Permissions in the app's navigation. Every permission is listed with its scope, whether it is granted, and a Revoke button. Revoking takes effect at once.

After a revoke, every email that needs the permission fails at send time, recorded in History with the reason, until it is granted again. Emails that do not need it are not affected. Codes created before a revoke stay in your store; delete them under Discounts if you want them gone.

What this means for your privacy documentation

If you keep a record of processing or a list of processors, the app's role does not change: it acts as your processor, on your instructions given in Flow. With a permission granted, the categories of data it may see extend to the file in the metafield you chose. Our Data, privacy and security page and the DPA on our website describe this; the DPA is available on request from the Help page.

Frequently asked

Does the app read my orders once I grant Orders? No. It reads one metafield on one order while it sends an email whose layout attaches a file from that metafield. There is no sync, no list and no background reading.

Can I grant Orders but not Files? You can, but the file cannot be attached then: a metafield stores only a reference, and reading the file behind it needs the files permission. The picker asks for both together, and the Permissions page shows each on its own.

Why does the consent dialog say "View customer data" and "device and activity data"? That is Shopify's standard wording for the orders scope, listed in every app's dialog. The app reads none of those fields.

What happens to the file after sending? It is attached to the email and discarded. It is not copied into the app's storage and does not count against your storage allowance.

What does a created discount code look like in my store? A code discount named "Email code PREFIX-XXXXXX", one use, with the settings of the block. You can find, edit or delete it under Discounts like any other.