Privacy policy

Last updated October 28, 2026

Whittle is a Shopify app that checks a store's search engine optimization, helps fix it and reports on the results. This policy explains what Whittle reads, what it stores, and what it does with that information.

What Whittle reads from your store

  • Blog posts: titles, content, addresses, publish dates, tags and search titles and descriptions.
  • Products, collections and online store pages: names, types, vendors, tags, categories, options, variant barcodes, descriptions, search titles and descriptions, and product photos with their alt text.
  • Your shipping and refund policies, so product FAQs answer those questions correctly.
  • URL redirects, so new redirects never conflict with existing ones.
  • Your store's name, description, domain and account email (used only to send Whittle's emails to you: the weekly summary and monthly report if you leave them on, and a note three days before a trial ends).
  • Your live theme's app settings, only to check whether the Whittle SEO embed is switched on.
  • Orders from the last 60 days: the order total, date and currency, and where the shopper's visit came from (the referring site, the first page they landed on and any campaign tags), and the app or channel that placed the order. This is used only to count orders and sales that came from search engines and AI assistants.

Whittle never reads shopper names, email addresses, phone numbers, postal addresses or payment details, and it does not store any individual order. It keeps only totals, such as how many orders and how much in sales came from search, and which pages those visits started on.

For running the service, Whittle also keeps your store's address with its plan, install and uninstall dates, and how much AI work it did for the store each day. When Shopify sends a shop data deletion request after an uninstall, those records keep their counts and dates but the store's address is replaced with a one-way code.

What Whittle changes

Only when you choose to apply a fix, Whittle creates or updates URL redirects, hides blog posts, updates links inside blog posts, replaces a post with a rewrite you approved, updates search titles and descriptions on posts, products, collections and pages, updates product photo alt text, updates a product's or collection's description, saves product FAQs, and sets which products appear under a blog post. When you save an AI draft, Whittle creates it as a hidden blog post. If you turn on Autopilot's fill-in-blanks setting, Whittle adds missing photo alt text and blank search titles and descriptions without asking each time; it never replaces text you wrote. Every change is recorded with what it replaced so you can undo it.

The Whittle SEO theme embed

If you switch on the Whittle SEO embed in your theme, it adds search markup, product FAQs and product cards to your storefront (FAQs and product cards while you're on a paid plan). When a shopper lands on a page that doesn't exist, it sends Whittle that page's address and the name of the website they came from, so you can fix the broken link. Nothing else about the shopper is sent or stored: no IP address, cookie or identifier.

Google Search Console

If you connect Search Console, Whittle requests read-only access to your site's search performance data (clicks, impressions, positions and search queries). The access token is encrypted at rest. You can disconnect at any time in Settings, which revokes Whittle's access with Google. Whittle's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI processing

To judge topic fit and write titles, descriptions, alt text, collection intros and posts, Whittle sends post titles and content, product, collection and page names, descriptions, options and tags, product photo addresses, your shipping and refund policy text, your answers on Your brand (market, customers, voice and any writing sample you add) and search queries to Anthropic's Claude API. For AI answer checks, Whittle also asks Claude, with web search, shopper questions about what you sell, to see whether answers mention your store. Anthropic does not use data sent through its API to train its models. Nothing is written to your store unless you ask for it or switch on Autopilot's fill-in-blanks setting.

Keyword data

When keyword volumes are switched on, Whittle sends keyword phrases, and on the Scale plan the website addresses of competitors you add, to DataForSEO to look up search volumes and rankings. Never post content or anything about your customers.

Email

Whittle emails your store's account email through Resend, an email delivery service: a weekly summary of what it did and a monthly results report (each can be switched off in Settings), and one note three days before a free trial ends. Nothing is sent to your customers.

What Whittle stores

  • Audit and store scan results, your cleanup plan and AI suggestions waiting for review.
  • A record of changes Whittle made, including what each one replaced, so changes can be undone.
  • AI drafts and rewrites you asked for, until you discard them or uninstall.
  • Search performance summaries, tracked searches and their weekly positions, and totals of orders and sales from search.
  • Broken link addresses logged by the theme embed, with hit counts and referring site names.
  • AI answer check results, and competitor keyword lists on the Scale plan.
  • Your robots.txt as it was last checked.
  • Your settings and, if connected, an encrypted Search Console token.
  • The access token Shopify issues to the app.

Whittle does not sell or share your data with anyone except the service providers named here, and only to run the app.

The free grader

Whittle's website has a free grader that checks any Shopify store's public pages: its public product and collection lists, a few product pages, its home page and robots.txt, the same pages any visitor or search engine can see. It keeps the result for that store's address so the page can be shared. It doesn't store anything about the person using it beyond a short-lived count to limit how often it runs.

Retention and deletion

When you uninstall Whittle, your Google access is revoked and everything listed above is deleted. Counts of how much AI work the store used this month are kept until Shopify's deletion request 48 hours after uninstall, which removes everything that remains. The one exception: so each store gets one free trial, Whittle keeps a one-way hash of the store's myshopify.com address and the date its trial started. It can't be turned back into the address and holds nothing else.

Contact

Questions about privacy or your data: support@whittleapp.io.