Which permissions does Cooee request, and what does each one do?
Cooee requests the following access scopes when you install the app. Each one maps to a specific part of the product.
Permission | What it powers | What breaks without it |
read_customer_events | Activates the Cooee web pixel, which records Shopify checkout events — and checkout events from third-party providers such as GoKwik and Shiprocket. | The pixel cannot be activated. Checkout Started, Billing Info Submitted, Address Submitted and Checkout Complete are all lost, along with every metric derived from them. |
write_customers | Writes visitor details captured by Cooee back to the Shopify customer record. | Data-collection pop-ups stop showing, so email and mobile capture no longer works. |
write_orders | Reads past and new orders. Write access is used only to tag orders with Cooee-attributed revenue and to clean up the identifiers Cooee added — see Shopify Token Security and Permissions FAQs. | Popular-item detection and revenue attribution stop working. |
write_discounts | Registers the Cooee discount functions behind our discount types and progress-bar milestones, and creates campaign discounts. | Discount-based campaigns and progress-bar milestones are unavailable. Existing discount data is untouched. |
read_products | Catalogue, price and stock data for recommendation and product widgets. | Widgets have no catalogue to render, and out-of-stock items cannot be filtered out. |
read_themes | Installing and updating the Cooee theme app extension and to run theme A/B tests. | Cooee cannot be embedded in your storefront. |
write_pixels | Registers the Cooee web pixel extension. | The pixel cannot be registered. |
write_files | Uploads campaign creatives, assets and videos to your store's CDN. | Campaign images and videos must be hosted outside your store. |
write_draft_orders | Cart and pre-checkout flows, and gift-card-based campaign rewards. | The corresponding campaign types are unavailable. |
read_all_orders | Reads order history beyond Shopify's default 60-day window. | Nothing. This scope is optional and Cooee works without it. |
Why does the install screen say Cooee has access to sensitive customer data?
Cooee is built on Shopify's web pixel, and the events it needs — Checkout Started, Checkout Complete and the rest — are Customer Event data. Reading them requires the customer-event access scope.
On Shopify's side, that scope is bundled with access to personally identifiable customer data such as name, address and phone number. There is no narrower scope that grants only the anonymised event stream. So as soon as an app requests customer-event access, Shopify shows the notice about access to sensitive customer data — and it shows it to every app in this category, including ours.
Shopify's consent model is also binary per scope: a scope is either granted or not. There is no way to accept the event stream while declining the PII bundled with it.
The notice therefore tells you which category of data an app can reach, not how much of it the app actually uses. For exactly what Cooee collects and how it is stored, see Data Privacy & PII FAQs.
Can I install Cooee without granting customer data access?
No. Every customer-data scope maps directly to a feature, as listed above: read_customer_events is checkout tracking, write_customers is email and mobile capture, and write_orders is revenue attribution. These are what Cooee's personalisation and reporting are built on, so removing them does not produce a reduced version of Cooee — it produces an installation that cannot do its job.
Removing only some of them does not help either. Because Shopify shows the sensitive-data notice when any customer-data scope is present, partial removal costs you features without giving you a cleaner install prompt.
Our brand does not run discounts. Can those permissions be removed?
write_discounts is the one scope Cooee does not otherwise depend on. Dropping it disables discount functions and dynamic discount creation at the source — Cooee cannot create or modify a discount, regardless of how a campaign is configured — and leaves the rest of the product working.
We do not currently support configuring this per store, so it is not something you can toggle today. If this matters for your brand, raise it with your Cooee contact.
Will these permissions change over time?
They can, as the product changes. Shopify requires apps to request approval for new scopes, and you will be prompted to review and accept any change before it takes effect. The current list is always shown on the Shopify install screen.