What How’s My Store reads, what it keeps, who else sees it, and how to get it deleted. Written to be read, not skimmed past.
How’s My Store (howsmystore.com) is operated by [to be confirmed] (“we”, “us”). We are the controller of the personal data described here. Questions and requests: [to be confirmed].
How’s My Store shares its sign-in system with ShopAltAI, another service we operate: one email address and password (or Google sign-in) works for both. Your store data in How’s My Store is kept in its own records and isn’t used by ShopAltAI.
When you enter a store address on our home page, we check that store the way a visitor or a search engine would. We read:
robots.txt and sitemap;Our requests identify themselves as HowsMyStoreBot and are rate-limited. We never log in, never submit forms, and never read anything behind a password. The report we produce is stored and can be opened by anyone who has its link, so share the link only with people you want to see it.
To limit abuse of the free check we record a one-way hash of your IP address (a salted SHA-256 digest). We don’t store the IP address itself, and the hash can’t be turned back into it.
When you connect a store we keep its address and run audits on it. An audit reads your published catalogue — product titles, descriptions, short descriptions, prices, categories, tags, SKUs, image addresses and alt text — plus your robots.txt, sitemap and a sample of product pages. We keep each audit’s results so you can see how the store changes over time. We don’t read orders, customers, payments or anything else about your shoppers.
To publish fixes, you can give us one of:
write_products scope (and write_files for image alt text).We check the access works when you save it (for WooCommerce, with a request that changes nothing), then store it encrypted with AES-256-GCM. It is never shown back to you, never logged, and used for one thing only: reading the product fields you’re fixing and writing the changes you explicitly publish.
Be aware that this kind of access can reach more than we use: a WooCommerce read/write key works for orders and customers too, and the store’s own settings decide what a Shopify token can do. We only ever call the product endpoints. Remove the access from How’s My Store whenever you like — and you can also revoke it in WooCommerce or Shopify, which stops it working everywhere.
We keep the fixes we propose, your edits, whether you accepted or rejected each one, and — for everything we publish — the value each field had just before we changed it. That history is what makes undo possible, so we keep it for as long as the store is in your account.
When you email a report, we send it from reports@howsmystore.com to the addresses you type. Your account email is shown to the recipients as the person who ran the audit, and replies go to you. We keep a record of each send — which audit, the recipients’ addresses, and when — so you can see what you’ve sent and so we can limit sending to stop misuse. We use recipients’ addresses only to deliver that one email: we don’t add them to a list, email them again or share them. We keep the record for up to 24 months, and it goes sooner if you delete the audit or your account. Please send reports only to people who’d expect to receive them.
When you download a free-check report as a PDF, we record a scrambled (hashed) form of your IP address and the time, to limit downloads per day — the same way we limit free checks (section 2).
Fixes are written by an AI model using an API key you provide (Google, OpenAI or another provider we list). We store the key encrypted with AES-256-GCM and use it only to generate fixes for your store. If you’ve saved a key in ShopAltAI and none in How’s My Store, we use that one.
To write a fix we send the provider the product’s name, current text, category, tags and SKU, and for some fixes its photo. That happens under your account with the provider, so their terms and privacy policy apply to it, and they bill you for it. We don’t send your store’s content to any model except the one you chose, and we don’t use it to train models.
We measure the steps people take — opening the home page, running a check, signing up, connecting a store, publishing a first fix — so we can see where the product loses people. To link those steps before and after sign-up we give your browser a random identifier in a first-party cookie. These records hold that identifier, your account (once you have one), the step, and details such as the store address checked. They never hold your email address or your IP address.
Our hosting provider, Vercel, also counts page views with its Web Analytics, which doesn’t use cookies or identify you. We don’t use advertising trackers or third-party analytics beyond that.
| Name | What it’s for | Lasts |
|---|---|---|
Sign-in cookies (sb-…) | Keep you signed in. | Your session |
hms_aid | The random identifier described in section 9. | 1 year |
hms_seen | Records that this browser’s steps have been linked to your account, so it’s done once. | 1 year |
| Local storage | Remembers whether you collapsed the app’s sidebar. | Until cleared |
All of these are first-party and needed for the service to work as described. We don’t use advertising cookies.
We use these providers to run How’s My Store. Each handles data only on our instructions, to provide their service to us:
| Provider | What for |
|---|---|
| Supabase | Database and sign-in |
| Vercel | Hosting, and the page-view counts in section 9 |
| Sign-in with Google, if you use it; delivering our account emails and reports you send |
The AI provider you choose (section 8) acts under your own account with them, not ours. We share data with anyone else only if the law requires it, or as part of a sale or merger of the service — in which case this policy would continue to apply to your data.
Data travels over HTTPS. Store access and AI keys are encrypted at rest with AES-256-GCM and are only decrypted on our servers at the moment they’re used. Access to our database is restricted, and each account can only see its own stores.
To delete your account and everything above, email [to be confirmed]. We’ll confirm when it’s done.
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy, object to or restrict how we use it, and withdraw consent you’ve given (for example, by removing a store’s access). Email [to be confirmed] and we’ll respond within 30 days. You can also complain to your local data protection authority.
How’s My Store is a tool for businesses and isn’t meant for anyone under 18.
If we change what we collect or how we use it, we’ll update this page and its effective date. If a change affects data we already hold, we’ll email your account’s address before it applies.
See also our terms of service.