Is Luseri secure? Access, data and privacy

The access Luseri asks for, and why

Shopify offers no sign-in button for Partner data, so you create the API client yourself, in the Dev Dashboard under Organization settings. You then paste the address of your app's page in the Partner Dashboard, from which the organization and app IDs are read, and the client's token. Luseri checks the token with Shopify before storing anything: if Shopify refuses it, nothing is kept.

The connection guide asks for a client used by Luseri alone: you can delete it without touching your other tools, and Shopify's limit of four requests per second counts client by client. It also says to leave "Manage app subscriptions" unticked, a permission Shopify's documentation does not describe yet. What the Partner API returns, permission by permission, is in the Shopify Partner API guide.

Why it can only read

Because the code refuses everything else. Shopify ties two writes to "View financials": appCreditCreate, which gives a store a credit, and appSubscriptionCancel, which cancels a merchant's Shopify App Pricing subscription. The connection guide tells you not to tick that permission unless you sell annual plans.

Whatever the token allows, Luseri's Partner API client sends four read queries only: the app's name, its events, its transactions, and the payout events. Before every call, it checks that the GraphQL document is a query and contains no mutation or subscription, and stops if it does not. Automated tests check that every call it makes passes this rule and that a mutation is refused.

On Google's side, the service account asks only for the read-only Analytics scope (analytics.readonly). On the App Store, Luseri reads public pages and has no account to act with.

How your token and your account are protected

• The Shopify token is encrypted with AES-256-GCM before it is stored, with a key derived from a secret only the server holds. An encrypted token that has been altered is refused.
• It is decrypted only at the moment of calling Shopify, and never sent back to your browser.
• If Shopify later refuses it, for instance because you deleted the API client, the dashboard says so and asks for a new token; the history already copied is kept.
• Passwords are never stored, only a scrypt fingerprint, and must be at least ten characters long.
• A session is a random token in a cookie the page's code cannot read (HttpOnly, Secure, SameSite=Lax). The database keeps only its fingerprint, for 30 days. Changing your password signs out your other devices.
• Failed sign-ins are limited: 8 per 15 minutes from one IP address, 8 for one email address from one IP address, 40 for one email address overall.
• Requests that write anything are refused when they come from another site, and browsers are told to use HTTPS only.
• Each account sees only its own apps: every read goes through the account's ID, and asking for another account's app returns "not connected to your account". Automated tests check this isolation.

Google Analytics: a Viewer role and a proof of ownership

You add Luseri's service account as a Viewer of your GA4 property, from Google Analytics' access management. There is no password to share and no Google sign-in to approve, and you can remove the role at any time.

The same service account serves every user, so being able to read a property proves nothing about who owns it. The first time you connect a property, the page gives you a code, luseri- followed by eight characters unique to your account, to add to the property's name; only someone who can edit the property can do that. Luseri reads the name once to check it, and you can remove the code afterwards.

What is read, once a day: views and visitors per day, Install clicks, where visits come from, the App Store page each view came from (with the search typed and the position held), by country and language, and the installs Shopify confirms. Only pages served by apps.shopify.com are read. The first read covers a year, the later ones the last 35 days. Nothing is written to the property. These fields are described in App Store search terms in GA4.

The App Store robot

Reviews, rank, competitors and tracked keywords come from public App Store pages, read without signing in and without any access of yours. The robot presents itself under its name, LuseriBot, waits at least 1.5 seconds between two requests, reads each page once a day, and stops when the site refuses (codes 403 or 429). These readings are public data shared between accounts: a listing followed by ten accounts is read once.

What is kept, and for how long

According to its privacy policy, Luseri sells no data and shows no ads.

Where the data is, and who handles it

The servers run at Vercel and the database at Neon, both in Frankfurt, Germany. Other companies handle one task each, as listed in the privacy policy:

The privacy policy says these companies use the data only to provide the service, that Anthropic does not use it to train its models, and that transfers out of the European Union rely on the European Commission's standard contractual clauses or on the EU–US Data Privacy Framework.

What reaches Anthropic: only when you ask the assistant a question, your question, the conversation so far and a summary of your app's numbers, computed in your browser from what the dashboard shows (metrics, plans, names of the top-paying and fading stores, uninstall reasons, public reviews, positions on tracked keywords, the public summary of your listing and of your competitors'). Luseri's server passes it on and does not store your questions or the answers. For translation, only the text a merchant wrote when uninstalling is sent, without the store's or the app's name; each translation is kept with that app and erased with it.

Who can see your data

Only your account sees your apps and their numbers. Luseri is published and run by Arthur Renard (who makes Luseri), who manages the hosting and the database. His admin page lists the accounts (email, sign-up date, last sign-in, names of the connected apps and which sources are connected), without their numbers.

For the data about the stores that use your app, you are the controller under the GDPR and Luseri is your processor: it uses that data only to show you your numbers and shows it to no other account. Its terms say a written data processing agreement can be signed on request.

Delete your data and take each access back

• Remove an app: Settings, Your apps, Remove. Its events, payouts, competitors, tracked keywords, Google Analytics numbers, tracking events and translations are erased. Public App Store readings, shared between accounts, stay.
• Delete your account: Settings, Delete my account, with your password. Your account, your connected apps, the Shopify tokens and every copied number are erased at once; database backups expire within 7 days.
• Shopify access: removing the app in Luseri changes nothing on Shopify's side. Delete the API client in Shopify's Dev Dashboard (Organization settings, then Users, then Security), and its token stops working.
• Google Analytics access: in Google Analytics, open Admin, then Property access management, and remove Luseri's service account (this takes the Administrator role). In Luseri, Disconnect in the settings erases the numbers already copied.
• In-app tracking: take the code out of your app. Removing the app also erases its write key and its tracking events.
• Emails: the link at the bottom of each one, or the settings, turns off the weekly report and the alerts.

What this page does not claim

Luseri is built and run by one person and does not claim any security certification, such as SOC 2 or ISO 27001. Its commitments are in its privacy policy and its terms; this page describes the code as of October 21, 2026. It is an independent tool, not affiliated with Shopify Inc. How the numbers themselves are calculated is in how Luseri calculates MRR, churn and retention, the general method in how to calculate MRR and how to measure churn, and each term in the Shopify app metrics glossary.