Security

How we protect your store and your shoppers

Your store's access

• Only four permissions: read orders (to measure the sales your popups bring in), create discounts (to issue single-use codes), add files (to put popup images in your own Shopify Files), and add customers (to save each signup to your Shopify customer list, with the consent they gave). LeLoop can't edit your products or your theme.
• Inside your Shopify admin, LeLoop signs you in with Shopify's own sign-in: every request carries a token Shopify issues for that minute only, so there's no separate password and nothing to steal from your browser.
• LeLoop's pages can only be shown inside your own store's admin, never framed by another site.
• The access Shopify grants us is short-lived (it renews itself every hour) and is stored encrypted (AES-256-GCM).
• Order and data-request messages are only accepted when signed by Shopify; anything unsigned is rejected.

Your shoppers' data

• We keep only what shoppers type into a popup (their email, and phone number if you ask for it) plus anonymous facts about each visit. We don't store any payment details, and we don't store IP addresses in our database.
• Shopper data is never sold or used for advertising, and only goes to you and the email and SMS tools you connect.
• When you uninstall, all of your store's data is deleted (Shopify notifies us 48 hours later), and it leaves our encrypted backups within 21 days. When a shopper asks your store to delete their information, we erase it too. You can export your signups at any time.

Encryption

• Every connection is encrypted (HTTPS), including the one between our servers and our database, whose certificate we verify.
• API keys you connect, such as Klaviyo or Postscript, are stored encrypted.
• The database is backed up daily. Each backup is encrypted before it leaves our systems, with a key only we hold, and kept 21 days.

Protection against abuse

• There's no LeLoop password to guess or steal: you sign in through Shopify. The public parts of the service are rate-limited.
• Discount codes are capped per visitor (20 an hour) and per store (300 an hour), so nobody can drain your store's discounts.
• Bot signups are kept off your list: a hidden field only bots fill in, a check for signups faster than anyone can type, a limit per network, and no throwaway inboxes. Your dashboard shows how many it blocked.
• Visitors can't choose whether they're in the comparison group that measures your results: it's decided with a secret key (how we measure).

Your storefront

• The LeLoop script is small (about 20 KB compressed; a spin-to-win wheel adds 2 KB, only when one is shown) and loads without holding up your page. Popups wait until your page has finished loading, so they don't slow down how quickly it appears.
• Popups run in their own isolated space on the page (Shadow DOM), so they can't break your theme's styles, and your theme can't break them.
• Popups work with a keyboard and screen readers: the focus moves into the popup and stays there until it closes, Escape closes it, results are announced, and animations stop for shoppers who turn motion off.
• On Shopify, you turn it on and off with one switch in your theme editor, with no code to paste or remove. On any other website, it's one line in your site's header.

How we build

• More than 600 automated tests run on every change, including the full app against a real database.
• Major changes are reviewed independently before release. For example, our revenue measurement was stress-tested on thousands of simulated stores before launch.
• Our servers and database run in the United States, on Render and Supabase.

Found a problem?

If you think you've found a security issue, please email leloop.team@gmail.com with "Security" in the subject. Security reports go to the top of the queue. See also our privacy policy and our data processing agreement, which includes how quickly we'd tell you about a problem.