How we keep Shopsteddy predictable.

Clear identity

Shopsteddy identifies itself as NBTBot/1.0. Direct crawler requests use Web Bot Auth with a public Ed25519 key directory, while browser-based QA runs through Cloudflare Browser Run and carries Cloudflare's own non-removable Web Bot Auth identity. We do not rely on a User-Agent alone as cryptographic proof.

Respect for the site owner's controls

• We respect robots.txt for ordinary crawling.
• We stay inside the authorised site and validated first-party scope.
• Redirects are checked before we follow them.
• Rate limits, blocks and security challenges cause us to slow down or stop.
• We do not rotate identities to evade those controls.

Handling scan evidence

We keep enough information to confirm what a scan checked, when it ran and what result it saw. This helps the store owner verify a result and gives us a trail to investigate if someone reports unexpected Shopsteddy traffic. We prefer small structured records where they are enough, and use screenshots or larger captures only when they genuinely help with diagnosis. Retention is limited by the account's evidence policy.

Shopify access is explicit

Public storefront checks do not require a Shopify password or Admin API token. A merchant can optionally give Shopsteddy Shopify's domain-bound crawler approval, which is stored as a protected credential and attached only to that store's eligible read-only requests. If another feature needs protected Shopify account data, we use Shopify's normal app authorisation flow and request only the permissions it needs.

Do not send Shopify passwords, private Admin API access tokens or other secrets to Shopsteddy support.

Customer and secret data

Normal monitoring is not intended to collect customer passwords, payment details or private API credentials. Sensitive values should not be stored in logs or evidence, and private signing keys are kept out of the public site and source repository.