Most Shopify app permission lists are written in marketing-speak so vague that a merchant cannot tell what the app actually does with the access. We hate that. This page is the opposite. Below is every single permission Viking Watermark requests during installation, mapped to the exact feature that needs it, with an honest note on what we do NOT do with that access. If you have a Shopify Partner reviewing the app for a security audit, send them this page.
The headline: five permissions, all of them on product / file / theme data. Nothing about customers. Nothing about orders. Nothing about payment information. We do not ask, and we could not access it even if we wanted to.
Quick facts
Viking Watermark requests four permission groups at install: read and write on products (to swap watermarked images in and originals back), read and write on files (originals are preserved in Shopify Files for rollback), read-only on themes, and store owner contact for billing and support. It does not touch customer or order data, and it adds no popups or branding to the storefront. Every permission maps to a visible feature; nothing is collected beyond what those features require.
The full permission list
When you click "Install app" on the Viking Watermark App Store listing, Shopify shows you a permission consent screen. Here is every line on that screen, in plain language.
| Permission | Scope | Why we need it |
|---|---|---|
| Products | Read + write | Read product images to watermark them. Write updates the product media reference to point at the watermarked file. |
| Files | Read + write | Read uploaded files to identify originals. Write uploads watermarked files and originals to Shopify Files for rollback. |
| Themes | Read only | Detect which theme is active so the storefront anti-theft script targets the right elements. |
| Store owner contact | Email + name | Send onboarding email, billing notifications, support replies. |
| Online store pages | Read only | Detect where product images are rendered (collection pages, product pages) so anti-theft covers them. |
That is the full list. Nothing else. We do not ask for orders, customers, draft orders, gift cards, marketing consent, locations, inventory, shipping, fulfillment, or any other commerce data. If a future feature needs additional access, Shopify will prompt you to re-consent. We will never quietly expand the scope.
The shortest test for whether an app is honest about permissions: can the app developer write a one-line answer for every single permission, mapping it to a feature you can see in the app? If yes, install. If no, do not.
Why we need read and write on products
Read access on products lets us list product images to watermark. Every bulk apply, auto-watermark, and rollback operation starts by reading the current product media. Without read, we cannot see what to watermark.
Write access lets us update the product media reference to point at the watermarked file (instead of the original). When you click "Apply watermark", we write a new product image record pointing at the watermarked file we just uploaded to Files. When you click "Rollback", we write the product image reference back to the original file. Both are atomic updates to the product media list.
What we do not touch with product write access: prices, titles, descriptions, vendor, type, tags, variants, options, SEO fields, metafields outside of viking_watermark.* (our own namespace), collections, publication status, gift cards. The Shopify API would let us read and modify all of these. We deliberately scope our queries to product media only.
Why we need read and write on files
Files read lets us identify originals when a merchant uploads via API or external tool. We hash the file content to detect duplicates and to find existing originals we may have stored before.
Files write lets us upload watermarked files (which become the new product image) and uploaded originals (which become the rollback source). We also delete obsolete watermarked files when you rollback (so the old watermarked file does not eat your Files quota).
What we do not touch in Files: any file uploaded outside of our workflow. We never read, modify, or delete files unrelated to product image watermarking. Your shipping rate PDFs, logo files, marketing PDFs, and any other Shopify Files content stays untouched.
Why we need read on themes
Read access on themes lets us detect which theme is currently active. The storefront anti-theft script (right-click block, drag-save block, DevTools block) needs to target the right elements, and different themes use different DOM structures for product galleries. We read the theme name and version so the anti-theft layer knows whether to target Dawn-style image grids, Crave-style lightboxes, Sense product carousels, etc.
We do NOT request write on themes. We never modify your theme files. The anti-theft script is loaded as a Shopify script tag (script tags are a separate Shopify API), not by editing your theme.liquid or any other theme file. If you uninstall Viking Watermark, the script tag goes with the app, your theme stays exactly as you left it.
Why we need store owner contact
Store owner contact (email and name) is the standard Shopify install scope. We use it to send three things: an onboarding email with setup links after install, billing notifications when your plan tier changes, and support email replies when you contact us.
We do NOT add you to any marketing list. We do NOT share your email with any third party. We do NOT send weekly promotional emails. If you want to opt out of the onboarding email, you can, and you will still get billing and support emails (those are required by Shopify Partner policy).
What we do not touch
The full list of permissions we never ask for, in case a security review asks. We do not have access to: customer names, customer emails, customer addresses, customer order history, order line items, order pricing, draft orders, fulfillments, shipping information, payment methods, gift card balances, store credit, inventory levels, locations, fulfillment workers, marketing consent settings, abandoned cart contents, checkout customizations, discount codes, price rules, blogs, articles, redirects, shop policies, app subscriptions other than our own.
If you are evaluating Viking Watermark for a Shopify Plus store with strict access controls, this scope matters. The blast radius of a Viking Watermark security incident is limited to your product images and your Shopify Files. Nothing more.
Three things we do not do with this access
Even within the access we do request, three behaviors we explicitly refuse to do.
- 01Sell, share, or analyze your product data for any third party. Your product titles, descriptions, and images stay private to your store. We do not run analytics across stores to find "trends" we can sell to anyone.
- 02Modify any product field besides image references. The Shopify API would let us edit prices, descriptions, or variants with the same scope. We never do.
- 03Use AI training on your photos. We do not feed your product photos into any model training pipeline. No third-party AI service receives your images. The watermarking algorithm is deterministic image processing, not machine learning.
That is the full transparency story. If a security reviewer needs a copy of our subprocessor list or a SOC 2-style description, email us. Install Viking Watermark free when you are ready.
For a broader perspective on auditing any Shopify app's permissions before install, our studio site has a general image-protection guide that covers the broader app evaluation checklist.
Frequently asked questions
Does Viking Watermark access my Shopify customer data?
No. We do not request the customers scope. We cannot read customer names, emails, addresses, or order history. The Shopify API would not allow us to even if we tried.
Does Viking Watermark see my Shopify order data?
No. We do not request the orders scope. We have no visibility into orders, line items, pricing, fulfillment, or shipping.
Does the app modify my Shopify theme files?
No. We never edit theme.liquid or any other theme file. The anti-theft script is added as a Shopify script tag (a separate API), which is removed cleanly when you uninstall.
What happens to my data when I uninstall Viking Watermark?
The app and its script tag are removed from your store. Watermarked product images stay as-is (Shopify keeps them in Files). Original files stay in your Shopify Files. Run a bulk rollback before uninstalling if you want the originals back as active product images.
Do you use my product photos for AI training?
No. Watermarking is deterministic image processing. No machine learning is involved. No third-party AI service receives your images. Your photos stay on your Shopify Files store and are never copied for any training purpose.
Is the app GDPR compliant?
Yes. We only process data you explicitly grant access to (product images, files, your contact email), and we honor the standard Shopify GDPR webhooks (customer data request, customer redact, shop redact). Email us for a copy of our data processing agreement if your jurisdiction requires one.
Where can I see the live permission list before installing?
The Shopify App Store listing for Viking Watermark shows the permissions in the "Data access" section. Click through to install and Shopify shows you the consent screen with the full scope before you commit.