CodeMaster

CodeMaster privacy policy

Last updated: November 12, 2026

CodeMaster is a Shopify app that works as an AI engineer for a merchant's own online store: it reads the store's theme and store data, proposes changes, and applies them only when the merchant approves. This policy explains what information CodeMaster uses and how.

Information we access

When a merchant installs CodeMaster, Shopify gives the app access to the store data the merchant approved:

  • Theme files (layout, templates, sections, snippets, styles, scripts, settings and translations).
  • Products, collections, stock levels, discounts, online store pages, blog posts, navigation menus, URL redirects, store policies, metafields, metaobjects and files (images and videos the merchant asks CodeMaster to upload).
  • Basic shop details such as the store name, domain and currency.

CodeMaster does not access or store customers' personal information, orders or payment details.

Information we store

  • Access credentials Shopify issues for the store, encrypted. For a store connected directly (without the App Store app), the credentials of the merchant's own app (client ID and secret, or access token), encrypted.
  • Proposed and applied changes, with the previous version of each changed file, so every change can be undone.
  • Theme backups the merchant makes or that CodeMaster makes automatically before it changes a theme (the newest backups per theme are kept).
  • The merchant's conversations with the AI engineer and their Section library.
  • For merchants who create a CodeMaster account to connect directly: their name, email, optional phone number, optional store name, store address, role and intended use, and a hashed password, and a log of their connection attempts.
  • Messages sent to CodeMaster support, with the reply email and optional phone number given.
  • Usage information, such as the number of AI requests, tokens and credits used, and the store's plan.
  • Files a merchant attaches to an AI request (images, PDFs, documents), kept for up to 7 days so the request can be completed.
  • Page speed results for the store's pages that the merchant asked CodeMaster to measure, and short notes the merchant asked the AI to remember.

How we use it

Only to provide the app's features: answering questions about the store, preparing changes, previews, applying and undoing changes, backups and history. We do not sell store data and do not use it for advertising.

AI providers

To answer a request, CodeMaster sends the request and the relevant parts of the theme and store data to an AI provider (OpenAI or Anthropic). They process it to produce the answer. Under their API terms, data sent through their APIs is not used to train their models.

Service providers

  • Vercel hosts the app; Neon hosts the Postgres database.
  • Cloudflare R2 stores theme backups and request attachments in a private bucket.
  • OpenAI or Anthropic process AI requests (see above).
  • Brevo sends account emails (welcome, password reset, support replies, plan emails) to merchants with a CodeMaster account.
  • Google PageSpeed Insights measures the speed of public store pages when the merchant asks for a speed check (only the page address is sent).

Hosting and security

Connections use HTTPS, and store access credentials are encrypted at rest. Passwords are stored only as salted hashes. Theme changes and store changes are only made when the merchant applies them.

Retention and deletion

When a merchant uninstalls CodeMaster, Shopify asks us to erase the store's data 48 hours later, and we delete everything CodeMaster stored for that store: credentials, change history, file versions, backups (including those in Cloudflare R2), conversations, speed results, notes and the Section library. A merchant can also delete backups and library entries at any time in the app.

Your rights

A directly connected store can be disconnected at any time on the Connect page, which deletes everything CodeMaster stored for it. A CodeMaster account can be deleted there too (Delete account); its directly connected stores are disconnected and their data erased.

Merchants can ask for a copy of their data or for it to be deleted. Because CodeMaster does not store customer personal data, customer data requests forwarded by Shopify have nothing to return or erase.

Contact

Questions about this policy or your data: sellsmartlycontact@gmail.com.