LVNDRWhat is stored
| Data | Why |
|---|---|
| Snapshots of products, collections, pages, blogs, posts, menus, metafield definitions and theme settings files, with the differences between versions | The change log and undo |
| Shopify admin event entries for those records, which may name a staff member as Shopify renders it | Attribution |
| Raw event deliveries from Shopify | Processing and retries; kept 30 days |
| Undo runs, restore points, alerts, restore proof reports | The features themselves |
| Agent runs: the agent's name, its task, its Shopify API client id when given, and which changes belong to it | Reviewing and undoing an agent's work |
| The reason an agent or API client gives for an undo or restore point, and the agent name it sends | Shown in the history and the audit log |
| The Shopify staff user id of whoever runs an undo | So the undo is attributed in the history |
| API keys as a SHA-256 hash, with label, prefix, scopes, expiry and last use; for OAuth connections also the client's name | Authenticating the API, MCP and CLI |
| OAuth refresh tokens and one-time codes (hashed), and the name and redirect addresses of each registered agent client | Connecting agents through OAuth |
| Stored answers to write requests that sent an Idempotency-Key; kept 24 hours | Replaying a retried write instead of running it twice |
| Your optional alert webhook URL and its signing secret | Sending alerts to your own systems |
| Your optional alert email address and proof store domain | Alerts and the restore proof |
| Your optional backup bucket settings (endpoint, region, bucket, folder, access key id; the secret key encrypted) and a record of each backup run | Off-site backups |
| The store's myshopify domain and the access token Shopify issues to the app | Talking to the Admin API |
Orders, customers, addresses and payment details are never read. The app does not request access to them.
When summaries are on, the diff of each change is sent to Anthropic to write one sentence. Nothing else from the store is sent.
Retention by plan
Changes older than the plan's window are pruned, together with the snapshot versions only they referenced. Version 1 of every record and its newest version are always kept, and so is anything an undo still points at.
The window is never cut below the longest one the store had in the last 30 days. Moving from a 365-day plan to a 90-day plan keeps the full year for 30 days before pruning to 90. A store without an active plan, or with a plan LVNDR does not recognise, is not pruned at all.
| Plan | Products | History | Alerts | API, MCP, CLI (reads/writes per minute) | Multi-store |
|---|---|---|---|---|---|
| Development store | unlimited | 365 days | yes | yes (120/20) | yes |
| Starter | 1,000 | 90 days | no | yes (60/10) | no |
| Growth | 5,000 | 365 days | yes | yes (120/20) | no |
| Scale | 20,000 | 365 days | yes | yes (300/60) | yes |
| Early access (before managed billing) | unlimited | 365 days | yes | yes (300/60) | yes |
Above the product limit the app warns and keeps tracking. Plans are chosen and billed through Shopify; Settings links to the plan picker.
Export
Settings has download links for the whole change log as CSV or JSON, and for the app's own audit log. The same export is available over the API; see REST API.
Each row holds the change's id, time, record, action, actor tier and kind, actor name, app title, summary and the diff as JSON.
Settings > Backups downloads the current state of every tracked record as a ZIP, or uploads it on a schedule to a bucket you own. See Backups and exports.
Delete
Settings > Data has “Delete all history”. It removes every change, snapshot, undo, restore point, alert, agent run, admin event entry and delivery held for the store, then takes a fresh first snapshot. You confirm by typing the store's myshopify.com domain.
Your store itself is not touched. API keys, store links and the audit log stay. The deletion cannot be undone, so export first if you may need the history.
To have everything removed, including keys and the store record, uninstall the app or email support.
Restore proof
The weekly restore proof writes sample copies of your records to a proof store and deletes them again. It only ever writes to a Shopify development store: this store, if it is one, or another development store that has LVNDR installed, has given this store a link code from its own Stores page (entering the code here needs a plan with multi-store), and has then chosen “Allow restore proofs” for this store there. A read link alone is not enough, and the other store can press “Stop” at any time. Before every run LVNDR asks Shopify, with the proof store's own access, whether it is a development store, and stops if it is not.
Audit log
Separate from the change log, the audit log records what the app itself did on your behalf: undos, rollbacks, API calls, key changes, exports, deletions. It is shown in Settings and can be exported there.
Uninstall
When the app is uninstalled, polling and checks stop and the session is removed. Every API key and OAuth connection is revoked at once, so no agent keeps access; after a reinstall, make new keys. Data stays for 48 hours.
Shopify then sends a redaction request and LVNDR deletes every row it holds for the store: changes, snapshots, events, deliveries, undo runs and undo jobs, restore points, alerts, agent runs, API keys, OAuth codes and refresh tokens, stored idempotent answers, store links and link codes, the audit log, proof reports, backup run records, and the store record itself with its settings (including the backup bucket settings).
If the app is reinstalled before that request arrives, the data is kept and the history continues.
Where it lives
- Railway (application hosting and the Postgres database, United States).
- Resend (email delivery, only when an alert address is set).
- Anthropic (summaries, only when the server has an API key).
- The webhook address you set, if any: each alert is sent there. It must be https on a public host.
- The backup bucket you set, if any: each scheduled or manual backup is uploaded there.
- Shopify (the platform the app runs on).
The full policy is at /privacy.