The short version: we read a few numbers a day per store, show them only to the people you choose, and you can pull the plug whenever you want.
How the encryption works, step by step, and a made-up account sealed exactly the way yours is stored: Security →
With read-only access (the read_orders and read_reports scopes) we read your daily sales totals — from Shopify Analytics when read_reports is granted — back to the first year the store sold anything, so prestige counts its whole history — otherwise by adding up the last 60 days of orders in memory — and keep a few numbers per day, plus the same numbers per hour for the last 90 days (they let a room run on one clock and the global report compare like for like): sales, orders, units and, when available, sessions and the sessions that completed checkout. Once a day we also read the last 30 days' sales by billing country and keep only the top country and its share, to place the store in a market for the benchmarks (you can pick the country yourself instead). We store only those aggregates, plus the shop's currency and timezone. We never store individual orders, customer data, addresses, products or payment details.
Only the people in the rooms you put a store into, and only for as long as it stays there — including the breakeven ROAS you set and the profit estimate built on it (a room owner can keep spend, profit and scores private for everyone). Hide your store's name and the room sees a codename instead. The one public view is the global leaderboard: each store's revenue for a period, converted to USD and rounded to the dollar, under a rank — never a name, a codename or anything that stays attached to a store from one day to the next — plus everyone's combined revenue and ad spend, and a daily report built from the same numbers — blended ROAS, conversion rate, sales per order, CPM and how many stores are above or below their own last week, each store's day so far against the same hours of its past days — and benchmarks by country and by niche (the typical store's conversion, order value, ROAS and ad costs), every figure shown only when at least three stores count toward it. One switch on the Stores page takes your store off all of it. Inside a room, Borsello posts each day's winner and last place, with their sales, on the room's Roast wall — for the room's members only, sealed with the room's key, and a hidden store keeps its codename. We don't sell or share your data, and we don't turn it into statistics to resell. Sponsors never see anything. Leave a room or remove the store and your numbers disappear from it instantly.
We keep your name and email sealed with a key that belongs to your account alone, a keyed fingerprint of your email so you can sign in, a bcrypt hash of your password (never the password itself) and your profile choices. Your email is the one thing we open on purpose: to send password resets, reach you about your account and share important updates about the service (changes to it, to these terms or to how we handle your data) — and, only if you said yes (at signup or in your account settings, where you can say no again any time), with ROAStify news and offers; we record when you said yes. Sessions are signed cookies; changing or resetting your password signs out every other device. You can delete your account from your profile at any time.
Your store's name, its Shopify address, your Shopify access and refresh tokens, Dev Dashboard client secrets, Meta tokens and ad account IDs are sealed with AES-256-GCM before they reach the database, under a key derived for your account alone. Room names, nicknames, roasts and prizes are sealed with a key for that room. The master key lives only in the server environment — never in the database or its backups — so in our database a store is a random id and scrambled bytes: we never know which store is yours. Shopify tokens are short-lived and renew automatically. Once you paste a secret we never show it again. Uninstall the app from your Shopify admin, or revoke the token in Meta, and from that moment we have no access.
Chat messages are sealed with the room's key, readable only by the room's members, and a room keeps its latest few hundred. While someone has a room's Chill Room open we read its stores' numbers for today about once a minute, the same read-only way as the regular sync. An order alert tells the room that an order landed — never what was in it. The amount is for the store's owner alone, unless they switch on “show my amounts” for that room; they can switch it off again any time. The music is generated in your browser, and a background picture you choose stays in your browser too — neither is sent anywhere. So is the flex card: it's drawn in your browser from what's on your screen, with every store name blacked out. In the Focus room, the room keeps which YouTube video is on and where it's at, sealed like the chat; the video itself streams from YouTube (youtube-nocookie.com) straight to each viewer, so YouTube sees that you're watching it.
Prestige badges are worked out from the daily numbers we already keep — no extra access — and are stored with your profile with the day they happened, never with the store that earned them. Your profile page — your puppet (its colours, outfit and name, the name sealed like yours) and your badges with their dates — is visible only to people who share a room with you. New badges are announced on the Roast wall of the rooms you're in. The public Prestige page shows how many profiles hold each badge, never who. The global profiles board ranks every profile (the top 100) by prestige points: each row shows the badges (no dates) and the total those stores have sold since they opened, rounded to the thousand, under “Anonymous” — your name and puppet appear only if you switch that on in your profile. Taking your stores off the global leaderboard takes you off this board too.
Ideas you post on the public “Request a feature” board — a title and, if you like, a few lines — are public by design, so they aren't sealed. The board shows them without your name, your puppet or your email, and keeps one vote per person per idea without ever showing who voted. Posting is limited to one idea every three days per profile. Deleting your account deletes your ideas and your votes.
If you connect an ad account we read, with the ads_read permission, daily account-level spend plus impressions and clicks — back to January 1st, 2026, so the global leaderboard's spend covers the same days as its sales — and the same by the hour for the last 90 days: the inputs for ROAS, profit and the Ember Score. No audience data, no creatives, no personal data.
Disconnecting a store deletes its entire history. Deleting your account deletes your stores, ad accounts, metrics, roasts, chat messages, ideas and votes, badges and puppet, room memberships and any rooms you own. We keep no copies.
ROAStify is an independent project, not affiliated with Shopify Inc. or Meta Platforms, Inc. Questions? hello@roastify.club