What Bloom can see in your store, and what it can't
Shopify gives these to no app.
We change only our own pixel and order notes.
Reinstall within 2 days and it all comes back.
October 2026 · App security
Several merchants asked us about this. The attack worked because the affected apps loaded their own JavaScript into storefront pages, and attackers changed what that script did, sending shoppers to a fake checkout before Shopify's real one loaded. Here is where Bloom code can and can't run.
No Bloom code runs in the payment step, and Shopify gives card details to no app. Our only checkout piece is a small block on the order confirmation page that records the order for attribution.
The tracking under Settings → Customer events is a Shopify Web Pixel. It runs in Shopify's sandbox, can't read the page or form inputs, and ships through Shopify's own pipeline.
Bloom has one storefront script, for extra attribution. It is off unless you turn it on in your theme editor, and you can turn it off at any time.
Mostly read-only. We write only our own pixel and a tracking token in order notes. We can't change your theme, products or checkout.
Bloom is not among the apps Shopify delisted this month and has stayed live on the App Store throughout.
These are the permissions Shopify shows you when you install Bloom, grouped by what they're for. Bloom cannot change your theme, products, prices, customers or checkout.
Read
read_orders · read_shopify_payments_payouts · read_shopify_payments_disputes
What it lets us do: See sales, refunds, Shopify Payments fees and chargebacks
Why we need it: Revenue and fees in your profit
Read
read_products · read_inventory
What it lets us do: See the cost per item on each product
Why we need it: Cost of goods
Read
read_shipping · read_fulfillments · read_locations
What it lets us do: See shipping labels and who fulfilled each order
Why we need it: Shipping cost
Read
read_customers
What it lets us do: Tell new customers from returning ones
Why we need it: Customer and cohort reports
Read
read_price_rules · read_markets · read_reports
What it lets us do: See discount codes, markets and Shopify analytics
Why we need it: Reports that match Shopify
Read
read_themes
What it lets us do: Check whether our optional theme script is on
Why we need it: Show its status in Bloom settings
Write
write_pixels
What it lets us do: Install and update our own analytics pixel
Why we need it: Match orders to the ads that brought them
Write
write_orders
What it lets us do: Add note attributes to an order
Why we need it: Save the Bloom pixel token on the order, to match it to the visit that led to it
Follow a shopper from your storefront to the order confirmation page. This is everywhere Bloom code can run, and what it can see there.
1. Storefront
Loads from our server when you turn it on. Sees pages visited and, for logged-in shoppers, their customer id and email.
Off unless you turn it on · Theme editor → App embeds
2. Every page
Runs in Shopify's sandbox and receives only the events Shopify sends, such as page views and orders. It can't read the page or forms.
On · Settings → Customer events
3. Payment step
No Bloom code runs where shoppers enter card details. Shopify gives card details to no app.
Never
4. Thank-you page
Records the order id and buyer's email to match the order to its marketing source. It can't see payment details.
Only if added · Checkout editor
Shopify gives these to no app, and none of our code runs in the payment step.
Neither yours nor your shoppers'. You sign in to Bloom through Shopify.
The web pixel runs in Shopify's sandbox and cannot read form fields.
On Amazon Web Services (AWS) in the US West (Oregon) region, in managed, access-controlled databases.
Only our engineering team, to keep Bloom running or to fix a problem you report.
We use it to build your reports. We never sell it or share it.
2 days. Then we delete your store's analytics data. Reinstall before then and it all comes back.
That's our web pixel. It runs in Shopify's sandbox and gets only the events Shopify sends it. We use them to match orders to the ads and channels that brought them. It can't read your pages or forms.
That attack used code an app loaded into storefront and checkout pages. No Bloom code runs in the payment step. Our only storefront code is the optional theme script, which is off unless you turn it on. You can turn it off at any time in the theme editor.
Only in two ways: it installs its own pixel, and it adds note attributes to orders. It can't change your theme, products, prices or checkout.
We keep it for 2 days in case you come back, then delete your store's analytics data.
Write to us. An engineer reads every message and will reply.
Bloom Profit Analytics · Last updated 28 October 2026