Trust
Can a customer see somebody else’s order?
No. This page explains exactly what someone has to prove before Order Genie shows them anything, where those requests come from, and what we never collect. Each claim below was measured rather than asserted.
Before an order is shown
What the shopper has to prove
The email on the order has to match
A shopper gives the order number, then the email address used to place it. Until that matches, not one line of order data is returned — not the status, not the items, not the total.
A wrong email looks exactly like an order that does not exist
Both answer the same way. That matters more than it sounds: it means the chat cannot be used to work out which order numbers are real by trying them one after another.
An unfulfilled order gets no invented delivery date
When there is no tracking yet, Genie says the order is being processed and stops. It does not estimate a date to sound helpful.
Where the requests come from
Every storefront request is signed by Shopify
The widget does not talk to our backend directly over HTTP. Each request goes through Shopify’s app proxy, which signs it, and we reject anything that arrives without a valid signature.
Unsigned requests are refused
A request that reaches our API without Shopify’s signature is rejected outright. We probed this against the live build after deploying it, not only in development.
The shop and the customer identity are set by Shopify, not by the caller
Shopify overwrites both values on the way through. A caller cannot claim to be a different store, or a different signed-in customer, by editing the request.
The server refuses to start with the check turned off
Outside development, if signature verification is not enabled, the process exits rather than starting in an unsafe state. The safe configuration is not something an operator can forget.
Separation
One store’s data never reaches another
Measured on three layers, in both directions
We set up two stores with deliberately contradictory knowledge bases and checked retrieval, the code path, and the API boundary — asking each store’s questions against the other. Nothing crossed over in either direction.
What we never take
Payment data, and everything else we do not ask for
No card or payment details
Genie never requests them and never stores them. Payment stays where it belongs, in Shopify’s own checkout.
Encrypted in transit, with minimum scopes
All data moves over TLS. We request the narrowest set of Shopify permissions the features actually need, and the privacy policy names every subprocessor.
What this page does not claim
- We do not claim to be more secure than anything else you could install. We tested the alternatives in August 2026 and their order verification is at least as strict as ours — the email is checked, and the failure message gives nothing away either.
- Order lookup is the part described here. It is not a statement about every feature in the app; the privacy policy covers what data is processed and why.