Recon
Privacy Policy
Recon ("Recon", "we", "us") is run by Recon Labs of Queensland, Australia. It joins a brand's Meta ad account to its Shopify store so the team can see, per ad, whether it earned a new customer at a cost the brand can afford. This page says what we collect, where it goes, how long we keep it, and how to reach us.
Your account
When you sign up we store your name, your work email, your brand's name and your role on it. Your password is handled by our sign-in provider (Supabase Auth) and is stored only as a salted hash. If you invite teammates, we store their name, email and role the same way.
When you ask for access during the beta, we keep the email, brand, revenue band and Discord username you give us, and post them to our own team's Discord channel so we can reply.
This site sets no tracking cookies. The app keeps your signed-in session, and a few screen settings such as the last screen you opened, in your browser's local storage.
Our pages count visits with Cloudflare Web Analytics, which does not use cookies or follow you across sites. Fonts load from Google Fonts and the sign-in library from jsDelivr, so those two see your IP address and browser details when a page loads. All three are in the table below.
What we read from Shopify
You connect Shopify by installing the Recon app on your store and approving it. Stores set up before the app existed may instead connect with an access token or the credentials of their own custom app. Either way Recon asks for two scopes, both read-only:
read_orders: for each order, its number, total, the time it was placed, the landing page, UTM tags and traffic source of the visit that led to it, how many days the buyer took to order, the names, quantities and prices of the products in it, and the amount refunded; and the number of checkouts left unfinished each day. This is how revenue and orders are matched to the ad and the page that drove them.read_customers: for the customer on each order, their Shopify customer ID, lifetime order count and amount spent, so Recon can tell a new customer from a returning one and estimate lifetime value.
Recon also reads your store's name, domain and currency.
Recon stores one record per order: its order number, time and total, whether the buyer was new or returning, and the ad, traffic source and landing page that led to it. From those it builds daily totals: revenue, order count, new and returning customers, refund and cart-abandonment rates, revenue by hour and top products, per day, per ad and per landing page.
Recon never asks Shopify for a shopper's name, email, phone number or address, so it never has them, and it stores no customer ID. A customer's order count and amount spent are read during a sync to classify that one order and are not kept.
The access token is stored server-side only. No browser session, including yours, can read it back.
What we read from Meta
Through the Meta Graph API, with the permissions you grant when you connect: ad-level spend, impressions, clicks and results; each ad's copy, images and video; and the public comments on your own ads. Comments carry the commenter's public name, ID and text, exactly as anyone viewing the ad can see them. Recon keeps still frames and transcripts of your ad videos to describe them.
Other sources you can connect
- Microsoft Clarity: aggregate on-page behavior scores (scroll depth, rage clicks, dead clicks) for your store, not individual visitor sessions.
- Discord: if you paste a webhook, Recon posts a daily report with your brand's numbers into your own server. If you map teammates to Discord user IDs, we store those IDs so the report can mention the right person.
- Competitor research: Recon collects public ads from the Meta Ad Library, and public pages, for the competitors you name.
- Triple Whale and Loop Subscriptions: if you connect them, Recon reads per-ad spend and new-customer orders from Triple Whale, and checks your Loop key with Loop.
Your team's workspace
Recon also keeps what your team puts into it: profile photos, the ads, pages, notes and calendar events you add, training progress, and, if your team clocks in through Discord, each person's Discord ID, name and clock-in and clock-out times. Landing-page screenshots and the media you upload are stored with your brand. If you use the desktop app's tool vault, the sign-ins you save there are stored encrypted.
Connecting Recon to Claude
You can connect Recon to your own Claude account (Anthropic) so Claude can answer questions about your ads. You sign in with your Recon login, and Claude sees only what your role in Recon can see. That includes your store's daily totals and each ad's results, so those numbers go to Anthropic through your Claude account, under your agreement with Anthropic. Nothing is shared this way unless you connect it.
Who processes your data
We use these providers to run Recon. Each acts on our behalf under its own data-processing terms. We do not sell data.
| Provider | What it does for Recon | What it receives |
|---|---|---|
| Supabase | Database, sign-in and server functions | Everything Recon stores, including your account |
| Cloudflare | Hosting for this site, the app and the Claude connector; Web Analytics (cookieless visit counts); Workers AI transcribes ad videos, describes ad images and builds search embeddings | Web traffic and page-view counts; ad video audio, ad images, ad copy and transcripts; the connector's sign-in sessions |
| Resend | Sends our account emails: confirmation, invite and password reset | Your email address and the text of that email |
| Google Fonts | Serves the typefaces on this site and the app | Your IP address and browser details when a page loads |
| jsDelivr | Serves the sign-in library on this site and the app | Your IP address and browser details when a page loads |
| flagcdn | Serves the small country flags in the app | Your IP address and browser details when a flag loads |
| YouTube, Vimeo, Loom, Google Drive | Host the training videos played in the app | Your IP address and browser details when you play one |
| Meta | The source of your ad data (Graph API) | Requests made with the access you granted |
| Shopify | The source of your order data (Admin API) | Requests made with your store's token |
| Apify | Collects public comments on your ads and public competitor ads | Your ad and page identifiers; competitor names |
| TrendTrack, Similarweb | Public profile and traffic estimates for the competitors you name | Those competitors' web addresses |
| Anthropic | Claude reads ad copy, transcripts, video stills, comments and landing-page text to tag and summarize them and to draft briefs | That content. No shopper data, and no store numbers unless you connect Recon to Claude yourself |
| TypeSafe (Jev) | Classifies ad copy and video, for example tone, awareness level and concept | Ad copy, transcripts, written descriptions of video frames and concept names |
| Whop | Checkout for paid plans. Recon sells none during the free beta; the app loads Whop's checkout script | Your IP address and browser details; for a purchase, your email and plan. Card details go to Whop, never to Recon |
| Discord | Delivers your daily report and answers slash commands, only if you connect it; carries access requests to our own team | The report text, the numbers a command asks for, and access-request details |
| Microsoft Clarity | On-page behavior scores for your store, only if you connect it | Requests made with your Clarity token |
| Triple Whale, Loop Subscriptions | Ad and subscription numbers, only if you connect them | Requests made with your key |
Where your data is kept
Recon's database is hosted by Supabase in Sydney, Australia. Some of the providers above, including Cloudflare, Anthropic and Whop, process data in other countries, mostly the United States.
How long we keep it
We keep your brand's numbers and order records while your account is active, so trend reporting keeps working.
- To stop Recon reading your store, uninstall the Recon app in your Shopify admin. Shopify revokes the access at once, and Recon deletes its stored token as soon as Shopify tells it. 48 hours later Recon deletes the store's install record.
- If you connected your own custom app or access token instead, remove that app in Shopify, or tell us and we will delete the token.
- To stop Meta access, remove Recon's access in your Meta business settings.
- Tell us and we will also delete your brand's history, including its order records.
Your rights and deletion requests
You can ask for a copy of your account data, a correction, or deletion at any time by email (below).
If a shopper asks your store to erase their data, Shopify tells Recon and Recon deletes that shopper's order records. If a shopper asks what data is held about them, we send the store owner the order records Recon holds, which carry no name or contact details. Recon logs each of these requests without the shopper's details.
If you are unhappy with how we handle your data, tell us first. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Security
All traffic is served over HTTPS. Access tokens are held server-side behind row-level security, so no browser session can read them. Every connection is one you can revoke from the provider's own settings.
Changes to this policy
If this policy changes in a material way, the date at the top changes. Using Recon after an update means you accept the revised policy.
Contact
Questions about this policy, or a data request: support@reconlabs.app