CASEKIT
Security

How CaseKit handles your data

CaseKit sits between your customers and your store, so this page states the access model plainly rather than reaching for reassuring adjectives. The privacy policy is the authoritative legal statement; this is the engineering summary.

The access model in three parts

Gmail access

A Chrome content-script adapter reads the conversation you have open. No Gmail API restricted scopes, no mailbox-wide permission, no access to your other threads or attachments.

Shopify access

Read-only. CaseKit can retrieve order, customer and fulfillment data. It cannot refund, cancel, edit or fulfill an order, because it holds no write scopes.

What is transmitted

The minimum context needed to resolve an order: sender address, any order reference in the message, and a short snippet used to classify the request. Sent over HTTPS.

If you used CaseKit 1.x: this changed. The old extension was local-first and said no order data was sent to a CaseKit server. That was true then. It is not true of CaseKit 2.0, and we would rather explain why than quietly drop the sentence.

Why 2.0 is no longer local-first

CaseKit 1.x ran on the Shopify admin order page. You had already opened the order, so the data was on your screen already — the extension only had to read and format what was in front of it. Nothing needed to leave the browser because nothing needed to be fetched.

CaseKit 2.0 runs in Gmail. The Shopify order is not on your screen; that is the entire point. Finding it means asking Shopify, and asking Shopify means holding a credential for your store.

That left two options:

  • Keep the Shopify token in the browser extension and query Shopify directly from your machine. This preserves the local-first claim. It also puts a long-lived credential for your store inside browser storage, where any extension compromise, any shared machine and any exported profile exposes it.
  • Keep the token on a server, encrypted, and have the extension send only what is needed to identify the order.

We chose the second. It costs us the marketing line and it is the safer design: your Shopify credential is encrypted with AES-256-GCM, never sent to the extension, and revoked the moment you uninstall the app from Shopify.

What that means in practice

Compared with 1.x, CaseKit 2.0 transmits more and stores more. Specifically, three things now leave your browser that previously did not:

  • Candidate customer email addresses from the open conversation
  • Any order reference found in the subject or message
  • A snippet of the customer's message, capped at 800 characters

In exchange, 2.0 answers a question 1.x could not: which order is this email about? If that trade is not one you want to make, 1.x's model was genuinely more private and we will say so rather than pretend otherwise.

What has not changed: Shopify access is still read-only, CaseKit still cannot refund, cancel, edit or fulfil an order, and it still cannot send an email. The privacy policy is the authoritative version of all of this.

What we will not claim

A short list of things you will read on competing extension sites that would be untrue if we said them.

ClaimWhy we do not make it
"Your data never leaves your browser"Untrue for CaseKit. Order resolution happens on our backend, so context is transmitted.
"We never process email content"A short snippet of the current message is used to classify the request.
"100% private" / "military-grade encryption"Marketing language rather than a verifiable technical statement.
"We never store any data"Workspace state, settings and entitlements are stored. Full Gmail threads are not the data model and raw email bodies are not logged.

Read the privacy policy for the authoritative statement of what is collected and retained.

Human control by design

No automatic sending

CaseKit writes a draft into the composer when you press Insert Reply. Sending is always a person clicking Send in Gmail.

No order mutations

Refunds, cancellations, edits and fulfillment are outside CaseKit's access entirely, not just disabled in the interface.

Quiet failure

If CaseKit cannot resolve an order or reach Shopify, it says so in its own panel and leaves Gmail working normally.

Security questions

Does CaseKit use the Gmail API?
No. The Gmail workflow uses a Chrome content-script adapter that reads the conversation currently rendered on your screen. No Gmail API restricted scopes are requested.
What Shopify scopes does CaseKit request?
Read access to the order, customer and fulfillment data needed to resolve the order behind a conversation. No write scopes are used, so CaseKit cannot mutate anything in your store.
Where does the Shopify credential live?
Server-side, in CaseKit's backend, in encrypted credential state. It is not held in the browser extension.
Is data encrypted in transit?
Yes. Context sent for order resolution is transmitted over HTTPS.
The old CaseKit said local-first. What changed?
CaseKit 1.x read the Shopify admin page you already had open, so nothing needed to leave the browser. CaseKit 2.0 works in Gmail, where the order is not on screen, so it has to query Shopify. We keep that credential encrypted on our server rather than in the extension, which is safer but means CaseKit is no longer local-first. The security page explains the trade in full.
Can I revoke access?
Yes. Uninstall the app from your Shopify admin to revoke CaseKit's access to the store, and remove the extension from Chrome to remove the Gmail panel.

Read the full privacy policy

The privacy policy is the authoritative statement of what CaseKit collects, transmits and retains.

Add CaseKit to ChromePrivacy policy