Last updated: 2026-10-01What Yikes storesYour store and settings. Your myshopify.com address, store name, time zone, and the rules and wording you choose in the app.A change log. For each address change a customer makes or tries to make: the order’s id and name, whether it went through, which part of the address changed, where the customer made it, any difference in the total, and when. No address is in it.Email-link tries. The order id, whether the link’s code was right, and when, so a link can rest after too many wrong tries.A notification address. Only if you type one in Settings; otherwise emails go to your store’s own email address, read from Shopify when they are sent.Your ShipStation connection. Only if you turn it on: your ShipStation API key and secret, encrypted before they are stored, and never shown again in full.What Yikes reads but never storesWhen a customer opens the fix form, Yikes reads that one order from Shopify at that moment: its status, payment status, items, tags, shipping method, refund notes, the id of the customer it belongs to, and its shipping address (name, address and phone, the email only if you let customers change it, and the order’s delivery note only if you let customers change that). Yikes never keeps a customer’s name, email, phone number, address or note in its database, and never sees payment details.The old and new address of each change are written onto the order itself, in your Shopify store (under Address changes), and in the email Yikes sends you about the change.Shopify’s install screen also lists “device and activity data” (location, IP address, browser and operating system) because access to orders includes what Shopify records about each checkout. Yikes never asks Shopify for those details, and never logs or stores a customer’s IP address, location or browser. When a customer uses Yikes, Shopify’s own request check reads the browser’s name only to turn away bots.How it is usedTo show the customer the form when your rules allow it, to change the order’s shipping address through Shopify when they confirm, to settle a difference in tax or shipping (a refund, Shopify’s invoice, or marking a small difference paid, as your settings say), to tag the order, to put it on hold when you ask for that, to email you, to trigger Shopify Flow if you use it, and to send the new address to your ShipStation if you connect it. Nothing is sold or shared for advertising.Service providers8th Origin LLC operates Yikes. Netlify hosts the app, Neon stores its database, and Resend delivers the emails sent to you. Shopify supplies store and order data and carries out the change, the refund and the invoice. Shopify’s address service supplies each country’s states and field labels; only the country and the language are sent to it. ShipStation, only if you connect it, receives the new address of the order that changed, sent with your own key.Retention and deletionWhen you uninstall Yikes, every row for your store is deleted. Shopify’s customer redaction requests delete that customer’s entries from the change log and clear the record Yikes wrote on their orders.SecurityHow the data is protected, and what 8th Origin does if something goes wrong: Security and incident response.ContactQuestions about how Yikes handles data: danny@8thorigin.com.