Security

This page summarizes what we at Tsun Inc., the developer of the seven RuffRuff Shopify apps (RuffRuff 予約販売, Order Limits, Order Bonus, Selling Periods, Table of Contents, Product & Blog Tags and Author Profiles), do to protect your store and your customers' data. For each measure, we describe what we do and what it protects in your store. The information is current as of November 2026.

We do not hold your customers' personal information

The apps do not store the names, addresses, email addresses, or phone numbers of your customers (buyers) on our servers.

The apps also do not store payment information, such as credit card numbers. Payments are processed in Shopify's checkout. Deferred payments in RuffRuff 予約販売 also use Shopify's system, which charges the payment method that Shopify keeps on file, so we can charge customers without holding any payment information.

Information we do not hold cannot leak. Because our servers do not store your customers' personal or payment information, that information would not be included even if data on our servers were ever leaked.

We access only the data we need

We limit the permissions each app requests from Shopify to the scope its features need. For example, Table of Contents and Product & Blog Tags can only read pages and themes. They cannot change products or orders.

Narrower permissions mean a smaller impact if a bug or unauthorized access occurs. When an app needs a new permission, it cannot use that permission until the store owner approves it in the Shopify admin. So permissions never expand without the store owner knowing.

The keys that access your store data expire in one hour

When an app reads or writes store data, it uses a dedicated string called an access token. It works like a key to your store data. RuffRuff apps use keys that stop working after one hour, and they switch to a new key automatically.

Once stolen, a key with no expiry could be used indefinitely without anyone noticing. Because our keys expire in one hour, a stolen key could be misused for one hour at most.

The keys work only from our servers

We use a Shopify feature (IP allowlist) so that an app's key works only for requests sent from our servers.

Even if a key is ever taken out of our servers, it cannot be used from anywhere else to read or change store data. Combined with the one-hour expiry above, this limits both when and where a stolen key can be used.

We store app settings in your store

We store app settings and rules in your store, not on our servers. Shopify stores and protects the settings themselves, the same way it stores and protects the rest of your store's data.

Because our servers do not keep a copy of the settings, they would not be included even if data on our servers were ever leaked.

Only that app can change the settings that control how it works

We store settings that control how an app works, such as purchase limit rules and pre-order rules, in a location inside the store that only that app can change (Shopify app-owned metafields). Other apps and themes cannot change them. In the Shopify admin, these settings can only be viewed.

This stops a bug in another app or theme, or an accidental edit, from changing purchase limit rules or pre-order rules.

We check security on every update

Every time we change an app's code, we automatically run Shopify's official security checks. We also run a more detailed security review with AI on a regular basis.

When a vulnerability is found in an external program (library) that an app uses, we receive an automatic notice. We review these notices, starting with those that affect the production apps, and are working through the updates.

Attacks often target vulnerabilities that are already known. Checking on every change raises the chance that we can fix a problem before it enters the production app.

When a vulnerability is disclosed, we check the impact and let you know

When a vulnerability in widely used software, such as Node.js or PHP, is disclosed, we check the impact on RuffRuff apps and publish the result in the changelog. If there is no impact, we report that in the changelog as well.

When store owners learn about a vulnerability in the news, they can quickly check whether it has an impact, without looking inside the app.

Here are examples of past changelog posts.

We delete data for stores that uninstall an app

When a store uninstalls an app, we delete that store's data from the app's database. Store data does not remain in an app that is no longer used.

Requests from your customers to "show me my data" or "delete my data" (requests under privacy laws such as the GDPR) also reach the app from Shopify. RuffRuff apps do not hold your customers' personal information on our servers, so there is nothing to delete from our servers.

Only Order Limits records each customer's cumulative purchase data in the store (customer metafields), so it can check purchases against the quantity limit. When a store owner requests deletion of a customer's data from the Shopify admin, the app deletes this record automatically. In both cases, the store owner does not need to do anything in the app.

We limit who can access the production environment and when

The production environment where the apps run cannot be operated with everyday accounts. Only staff members we have approved can operate it, and only for a limited time, after switching to a dedicated administrator account. We do not give the AI tools we use internally any login credentials for the production environment.

By limiting who can access the production environment and when, we make it less likely that a staff member's mistake, or a takeover of an employee account, will affect store data. Even if an AI tool tries to take an unintended action, it cannot enter the production environment, so it cannot reach store data.

RuffRuff