Storebouncer privacy policy

Last updated November 9, 2026. Storebouncer (formerly Appal Bot Blocker) is made by Appal (appal.io) and is free to use. There are no paid or metered plans, so nothing is collected for billing.

What we collect

When a visitor opens a page on a store that uses Storebouncer, we receive the visitor's IP address, browser user agent, the page path and referrer, and a few browser signals (for example whether the browser reports automation). We look up the network and approximate location of the IP address. We do not receive names, email addresses, payment details or order contents.

At checkout, the Storebouncer web pixel tells us that a checkout started, completed or was refused by the store's checkout rules, with the order value. It sends no buyer details.

Checkout rules (for example a blocked email address or delivery address) are checked inside Shopify's own checkout, by a Shopify Function. The buyer's email, phone, name and address are read there and never reach our server.

From the merchant we store the store's settings, its visitor and checkout rules, the store owner's email address for the emails they choose to receive, and, if they connect it, an encrypted Cloudflare API token.

Browser storage

The app stores a few small values in the visitor's browser. They are not shared with anyone else. The pass is also added to the cart, so Shopify's checkout can check it.

• bb_vid (local storage, or session storage when the visitor declined analytics): a random id, so repeat visits by the same browser are counted once.
• bb_v (session storage): the result of the bot check for this visit, so it is not repeated on every page.
• bb_r (session storage): the last redirect, so a redirect that bounces back is not repeated.
• bb_spy (session storage): which spy tools were already reported in this visit.
• bb_pass (local storage): a daily pass that lets a real shopper's cart through checkout protection.
• bb_access (local storage): only in the store owner's own browser, after they open their owner access link.

Why

• To decide whether a visit is a bot, a server, a VPN or blocked by the merchant's rules.
• To show the merchant their visitor log, reports and alerts.

Retention

Visit records are deleted after 90 days. When a store uninstalls Storebouncer we stop collecting at once, and everything we hold for that store is deleted when Shopify sends the shop redaction request 48 hours later.

Sharing

We do not sell data and do not share it with advertisers. We use Railway for hosting, Amazon Web Services (SES) for email, and public IP datasets including DB-IP Lite (IP geolocation by DB-IP).

A merchant can connect their own Cloudflare account. Cloudflare then filters traffic to their store under the merchant's own agreement with Cloudflare, and we read back what our firewall rules there blocked, to show it in the app.

Security

Data travels over TLS and is stored in an encrypted database. Cloudflare API tokens are encrypted again with their own key. Only Appal staff who run the app can reach the data.

Data processing terms

By installing Storebouncer, the merchant and Appal agree to these terms. The merchant is the controller of their visitors' and buyers' personal data, and Appal processes it only on the merchant's behalf, only to run the app as described above, and only for as long as stated under Retention. Appal does not sell it, use it for its own purposes or combine it across stores. Appal helps the merchant answer data requests from their customers: Shopify forwards them to us and we act on them. A visitor or buyer who thinks they were blocked by mistake can contact the store, and the merchant can let them through.

Contact

Questions or requests: support@appal.io.