Security and data

What Molt can reach

Molt asks Shopify for two permissions, read themes and write themes. It has no access to products, orders, customers or payments, and it collects nothing from your shoppers.

What Molt writes

Molt writes files only to unpublished themes it creates. A guard in the code refuses to write to your live theme. It publishes a theme only when you click Publish or Roll back, and it removes only drafts it created.

Where your theme goes

• Molt's servers. Backups, merged themes and screenshots are stored in the United States on an encrypted disk.
• An AI model provider. When your team and the theme's maker changed the same lines, Molt sends that file to a model through a commercial API. It also sends short excerpts to name your customizations. The provider's commercial terms bar training on this material.

Theme files can contain secrets if someone pasted them into the code. Keep API keys out of your theme.

Your storefront password

If your store has a password page and you enter its password, Molt encrypts it per store and uses it only to open your storefront for comparisons. Molt checks it in a browser and never writes it to a log or a job record. Remove it from any upgrade's page.

Shopify's approval

Apps need Shopify's approval to change theme files. Shopify approved Molt's request on November 5, 2026, for backup, restore and upgrades that keep a store's customizations.

Reporting a problem

Email a security concern to the address on the support page.

The privacy policy has the full detail on data and retention.