Privacy Policy

The Shopify API Client is a Chrome extension that runs the Shopify Admin GraphQL API using your own Shopify admin session. To do that, it reads and stores a small set of values:

• Shopify session and CSRF headers. When you have a Shopify admin tab open, the extension captures the session and CSRF request headers Shopify already sends (for example the CSRF token and trace headers). These are stored locally in your browser so the extension can authorize Admin GraphQL requests as you. The requests run with your existing Shopify login, the same access you already have in the admin.
• Store handle. The extension reads the store handle from the admin URL to build the correct GraphQL endpoint.
• An account. Signing in is optional and only needed for the paid features (AI chat, the MCP bridge, bulk operations and CSV import/export). If you sign in with Google or GitHub, we receive and store your email address, your display name, and the account identifier from that provider. A token issued by the Heltra backend is stored locally and sent with backend requests to identify your account.
• An install identifier. A random identifier (installUuid) is generated once when the extension is installed and stored locally. It is sent when you start a free trial, as an abuse signal.
• Your saved queries and history. Query history and editor state are stored locally in your browser.

Most of what the extension handles stays on your device. Shopify session and CSRF headers, the store handle, the install identifier, and your query history are kept in local browser storage (chrome.storage.local). Your Shopify admin data returned by GraphQL is shown in the extension and is not sent to the Heltra backend unless you use a feature that requires it.

Some features do send data to the backend:

• AI chat and agent. If you use the optional AI chat or agent, your chat messages and any images you attach are sent to the Heltra backend so the model can answer. When the assistant runs a GraphQL query on your behalf, the query runs in your browser and its result is returned into the conversation, so that result reaches the backend and the model provider too. Your account token is sent with these requests. If you would rather store data did not leave your browser, use the editor rather than the chat.
• Billing. Starting a trial or managing a subscription sends the install identifier and account details needed to set up and check your plan.
• Free-trial abuse prevention. When you start a free trial we record the install identifier, your IP address, your browser user agent, and your Chrome profile identifier. This exists so one person cannot claim unlimited trials, and it is used for nothing else.
• MCP usage counting. Each MCP tool call asks the backend for authorization first, sending your account identifier and an opaque identifier for that tool call. This is how the free allowance is counted. The GraphQL you run through the MCP is not part of that request.
• Local MCP bridge. The extension can connect to a local bridge process on your own machine (a local WebSocket) so a local MCP client, such as a developer tool you run yourself, can run GraphQL through your open store tabs. That traffic stays between the extension and the local process on your computer. The GraphQL operations themselves, and their results, never reach our servers: they travel from your MCP client to the bridge on your machine, into the extension, and out to Shopify.

The extension relies on a small number of services to work:

• Shopify. All Admin GraphQL requests go to Shopify using your own session. You are already logged in to Shopify, and the extension acts on your behalf within that session.
• Heltra backend. The optional AI and billing features talk to the backend at shopify-graphql-ai.fly.dev, hosted on Fly.io.
• OpenRouter. When you use the AI chat or agent, the backend sends your chat content and the store context you provided to OpenRouter, which routes the request to a language model provider to generate a response.
• Stripe. Payments and subscription billing are handled by Stripe. Card details are entered with Stripe and are not stored by the extension.

Data is used to run the features you ask for: executing GraphQL against your store, answering AI requests, preventing trial abuse, and managing billing. Your data is not sold. It is not shared with third parties except the services listed above, and only as needed to provide the feature you are using.

Locally stored values live in your browser until you clear them or remove the extension. The install identifier is cleared when the extension is uninstalled. Captured Shopify auth headers are also cleared automatically when a request is rejected, for example on a 403 response. You can remove the extension at any time to stop all local storage and data collection by it.

If you created an account, ask us to delete it and we remove the account record, its usage counters and its billing identifiers. Stripe keeps payment records for as long as its own obligations require. Chat conversations are held in memory on the server for the life of a session and are not written to long-term storage.