PRIVACY.md

# Privacy

Shopify App Builder is a local, skills-only package. The package itself has no hosted backend, user accounts, analytics, telemetry, advertising identifiers, or data-retention system.

The installer copies bundled Markdown skills and scripts to a directory selected by the user. It does not read Shopify credentials, browser data, source files, or environment variables. It does not make network requests.

When an AI coding agent uses a skill, that agent and any tools the user enables may process repository content or connect to third-party services. Those actions are governed by the user's agent configuration and the applicable service policies, not by this package. Users should review proposed commands, keep credentials in secret stores or environment variables, and limit tool permissions to the task.

Security reports should use the private reporting process in [SECURITY.md](SECURITY.md).