Legal

Privacy policy

Curbcut is operated by Quantra Technology & Innovation, Inc. (Florida). Contact: support@curbcut.site.

What we store

For installed shops: shop domain, OAuth tokens, plan/subscription mirrors, scan results, findings, issue lifecycle, and the append-only evidence ledger. We request only read_products, read_content, and read_themes — no customer or order scopes.

Public scanner

URLs submitted to the free scanner are fetched server-side with SSRF protections. We do not create a persistent evidence ledger for public scans.

Retention

On uninstall, tokens are wiped. Shopify’s shop/redact webhook triggers anonymization of shop identity while preserving hash-chain integrity constraints where applicable.