Privacy policy

Last updated: 25 August 2026

Rogus is a Shopify app that turns a merchant's product catalog into product feeds for shopping channels, and can send those products to Google Merchant Center. This page explains what data it reads, what it stores, and who it is shared with.

How we protect your data

Security procedures are in place to protect the confidentiality of your data, including any data Rogus receives from Google APIs. We use encryption to protect your information, both while it is being transmitted and while it is stored.

Encrypted in transit. Rogus is served over HTTPS, and every call it makes to Shopify and to Google uses TLS. Your data is never sent over an unencrypted connection.
Sensitive credentials encrypted at rest. The Google OAuth tokens that let Rogus act on your behalf are encrypted with AES-256-GCM before they are written to the database. The encryption key is held in the server environment — it is not in the database and not in our source code — so a copy of the database on its own does not reveal a token. The encryption is authenticated, which means a token that has been altered in storage fails to decrypt instead of being used.
Credentials are never written to logs. Google tokens and Shopify access tokens are excluded from application logs, error reports and diagnostics. When a request to Google fails we record the error code, never the credential.
Least access. Rogus asks for the smallest set of permissions that lets it do its job: one Google permission, and three read-only Shopify permissions. It has no access to your orders, your customers, your payments, or to anything in your Google account beyond your Merchant Center product listings.
The connection is verified, not assumed. The Google sign-in flow carries a value signed with HMAC-SHA256 that ties the request to your shop, and it is checked in constant time. Nobody else can attach their Google account to your store, or your account to someone else's store.
Restricted access by people. The database is reachable only with credentials held by the application itself, kept in the server environment and never in source control. Access by a person is limited to those who operate Rogus, and is used only to run the service or to help you when you ask us for support.
Deleted when it is no longer needed. Disconnecting Google revokes the token with Google and deletes the stored credentials. Uninstalling the app deletes all of your shop's data — see Retention and deletion below.
Incidents. If we become aware of a security incident affecting your data, we will act to contain it and will contact you at the address we hold for your shop.

Shopify data

When you install Rogus it asks for read-only access to your products, inventory, and metaobjects (read_products, read_inventory, read_metaobjects). Rogus reads your catalog to build feeds. It never modifies your products, orders, or customers, and it never touches your storefront theme.

Rogus stores:

Your shop domain and the Shopify access token issued at install.
Your feed settings — which products a feed covers, how each field maps to your catalog, and the feed's target country and language.
The generated feed document, and a report of any products that could not be included.
Your current billing plan.

Rogus does not read or store any of your customers' personal data. It has no access to orders or customer records.

Google data

Connecting a Google account is optional. Feeds work without it — you can simply register the feed URL in Merchant Center yourself.

If you do connect one, Rogus requests these permissions:

https://www.googleapis.com/auth/content — to create a data source in your Merchant Center account, upload and remove your products, and read back the approval status Google gives them.
openid and email — to show you which Google account is connected, so you can confirm it is the right one.

Rogus stores:

The email address of the connected Google account, shown in the app so you can identify it.
The ID of the Merchant Center account you chose to publish into.
A Google refresh token, encrypted at rest using AES-256-GCM. This token is what lets Rogus keep your feed updated without asking you to sign in again.
A record of which of your products have been sent to Google, and a hash of what was sent, so Rogus only uploads what has actually changed.
The item-level problems Google reports about your products, so the app can show you what needs fixing.

Rogus uses this access only to publish and maintain your own product listings. It does not read anything else in your Google account, and Google data is never used for advertising, profiling, or training machine-learning models.

Limited Use

Rogus complies with the Google API Services User Data Policy, including the Limited Use requirements.

Rogus's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice that means the access you grant is used only to publish and maintain your own product listings: it is never used for advertising, never sold or transferred to anyone else, never read by a person except where you ask us to for support or where the law requires it, and never used to train machine-learning models.

Removing Google access

You can disconnect at any time from the Google page inside Rogus. That revokes the token with Google and deletes the stored credentials and the record of what was published. Products already in Merchant Center are left alone — Rogus does not delete your live catalog because you unlinked an app. You can also revoke access directly at your Google account permissions page.

Sharing

Rogus does not sell your data and does not share it with third parties for their own purposes. Data is transmitted only to services needed to run the app:

Shopify — to read your catalog.
Google — to publish your products to Merchant Center, when you have connected an account.
Railway — hosting and database storage.
Any alert destination you set up yourself — such as Slack, email, Telegram or Discord. These receive feed-status messages only when you configure them, and only to addresses you provide.

The public feed URL

Each feed is served at a URL containing a long random token. That token is the only thing protecting it, so anyone who has the URL can read the feed. The feed contains your product data — the same information visible on your storefront. Treat the URL as private, and share it only with the shopping channel it is meant for.

Retention and deletion

When you uninstall Rogus, Shopify notifies the app and all data for your shop is deleted — sessions, feed settings, generated feeds, Google credentials, and the record of published items. You can also request deletion at any time using the contact address below.

Contact

Questions about this policy or about your data: [email protected]