Privacy

FirstFrame Bot Blocker checks visits to a Shopify store for signs of bots and, if the store chooses, blocks them. This page explains what it reads and keeps. Last updated 4 November 2026.

What the app reads from Shopify

The store's name, main web address, time zone, plan type (to know whether it is a development store) and contact email.
The app asks Shopify for no access permissions at all. It never reads products, orders or customers.

What happens when someone visits the store

A small script in the store's theme (the "Bot Blocker" app embed, which the store switches on) checks the visitor's browser for signs it is driven by software. This happens in the visitor's browser; nothing is sent about it except a short code such as "robot-controlled".
Once per visit the script asks our server about the visitor's internet connection. Our server sees the visitor's IP address, as any web server does, and looks up which network it belongs to (for example "Comcast" or "Amazon Web Services") using Team Cymru's public network directory.
Visitor IP addresses are never written to disk or kept in records. They are held in memory for up to 24 hours only to avoid looking the same address up twice, and are then gone.
No cookies are set. The script remembers its answer for the rest of the visit in the browser's session storage, which is cleared when the tab closes.

What the app keeps

Daily counts per store: visits checked, visits flagged or blocked, the reason (for example "data-centre network"), and how many people pressed "I'm a person".
Per day, the names and numbers of the networks visits came from (for example "AS16509 Amazon"), with a count. Not who, not which IP, not which pages.
The store's settings (mode, what to block, the block-page message and contact email, networks it allowed).
Shopify access tokens for the store, so its settings can be saved to its theme. They are deleted when the app is uninstalled.

Counts are kept for 90 days and then deleted automatically.

What the app does not keep

No customer data of any kind: no shopper names, emails, addresses, orders, IP addresses or browsing history.

Who else sees data

Team Cymru (a public network directory) receives the network lookup for a visitor's IP address, as a standard DNS query.
Railway hosts the app and stores the counts above (encrypted at rest).
Our email provider delivers the one "your first week" email to the store.

Nothing is sold, used for advertising or shared with anyone else.

Deleting data

Uninstalling the app removes the script from the store and deletes the store's access tokens. About 48 hours later Shopify asks us to erase the store's data, and everything kept for that store is deleted. Shopify's customer privacy requests are answered too; as no customer data is held, there is nothing to send or delete.

How we protect data: security. The agreement with stores: terms.

Who we are

FirstFrame Bot Blocker is made in Singapore by FirstFrame, the team behind the Inlinex skate store, where it was first built to stop card-testing bots. Contact: adam@inlinex.com.sg.