Shopify app permissions
The merchant-owned app requests access to orders, historical orders, analytics, products, product feeds, product listings, publications, and markets. Several catalog scopes include write access. The setup guide displays the exact scope string before you install or update the app.
Google authorization
Google’s OAuth flow authorizes access to your available Ads accounts. You select the advertiser and optional manager account. GMCMax never asks for your Google password. The optional feed rule unpublishes qualifying products from Shopify’s Google & YouTube channel; it does not directly pause Google Ads campaigns or change budgets and bids.
Optional Google & YouTube feed automation
Automatic Google & YouTube unpublishing is off by default. A workspace owner or admin must explicitly activate it in Automations. The suggested threshold is 50% of the lowest current variant retail price with zero recorded Shopify units sold across imported history. You can adjust the percentage or deactivate it at any time. Saving settings or syncing data does not activate it.
Credential and session handling
Integration credentials are encrypted before database storage. GMCMax account passwords are stored as salted scrypt hashes, not plain text. Session cookies are HTTP-only, secure in production, and subject to expiration. Workspace-scoped queries separate merchant records.
Disconnecting and deletion
Disconnecting a source removes its stored credentials and stops future collection. Existing reporting history may remain. Workspace owners can delete their workspace and active data with their password and explicit confirmation from Settings.