Snapshots

Google is verified, Shopify and Meta are still waiting on reviewers

Needs attention
  • Google sign in plus Ads and GA4 were verified on 21 Oct.
  • Shopify app submitted 21 Oct; Meta Business Verification has sat in review since 16 Oct.
  • Meta App Review is drafted but two screencasts are missing.
  • Only read scopes everywhere; a new scope means a new review.
  • The Shopify app and Meta privacy URLs still point at staging.
3platform reviews open
Your call

Open a Business Help case if Meta verification is still in review on 30 Oct?

Security, privacy and legal · 9.7

Platform compliance

DraftLast checked 2026-10-26Owner Param

Answer

Where each platform's review stands, Shopify, Meta, Google and Slack, what each one requires of us and what must never change without a new review.

Today

Platform State What it unlocks Source
Google sign in and Google Ads plus GA4 Verified 21 Oct for adwords and analytics.readonly, plus openid, email, profile One click connect with no unverified warning memory brew-google-oauth-scopes
Google Ads developer token Basic access applied for on 16 Oct; the token already reads real accounts Lifts test limits brew/docs/connectors-approvals.md:19-24
Shopify public app "Brew" Submitted 21 Oct, about 23:15 IST; listing limited to its direct URL One click install for any store brew/docs/shopify-app-review.md:3-8
Shopify protected customer data Level 1: orders and customers, no names, emails, phones or addresses Order totals and counts brew/docs/shopify-app-review.md:18, 89-93
Meta Business Verification Portfolio 898394269362946, Yellow Monk Technologies LLP; in review since 16 Oct, still in review on 24 Oct Tech Provider verification, then App Review memory brew-meta-app-review memory brew-real-connectors
Meta App Review Draft filled 24 Oct for ads_read, business_management, public_profile and Marketing API access tier; two screencasts missing Meta connect for brands without a role on our app memory brew-meta-app-review
Slack app Public distribution on; no review needed; Marketplace listing parked Any workspace installs it brew/docs/connectors-approvals.md:15, 36
Klaviyo, Judge.me, GA4 by property No review: pasted read only key or our service account as Viewer Connect today brew/docs/connectors-approvals.md:6-13

What each review holds us to

  • Shopify: session tokens inside the admin, latest App Bridge first, install only from Shopify, GraphQL Admin API only, only the four read scopes, HMAC checked compliance webhooks, no billing while free. brew/docs/shopify-app-review.md:31-40
  • Shopify scopes: read_products,read_inventory,read_orders,read_customers; keep them in step with connectors/shopify.js and shopify-app.js. brew/docs/shopify.app.toml:5, 12-15
  • Shopify webhooks: data request and customer redact have nothing to send or erase; shop redact drops the store's key and numbers. brew/shopify-app.js:15-19, 30, 203-217
  • Google: never add a scope without a new review; never send include_granted_scopes; never re-run gcloud auth application-default login with the local client. memory brew-google-oauth-scopes
  • Meta: the screencast flow runs on Cozy, never Arata; never call DELETE /me/permissions. memory brew-meta-app-review handbook content/engineering/connectors.md

Loose ends

  • The Shopify app's URLs, redirects and webhooks point at staging, brew.joinsquareup.com; production waits for the review. brew/docs/shopify.app.toml:8, 19-31 brew/docs/production.md:125-127
  • Production runs with SHOPIFY_OAUTH=0. brew/tools/prod-env.sh:9
  • Meta's privacy and data deletion URLs point at staging's /privacy. memory brew-meta-app-review
  • Reviewers reach the product by emailing hello@ to be added to Cozy Snugglet. memory brew-meta-app-review

Tomorrow

Item Version Tag
Read only scopes on every platform v1 Stays
Shopify app pointed at production after approval, SHOPIFY_OAUTH=1 and the install URL v1 Changes
Meta App Review submitted once Business Verification passes v1 New
Built for Shopify badge: 50 paid installs, 5 reviews, Polaris, speed rules v2 New
Write scopes for posting: Meta and Instagram publishing permissions, Shopify write scopes, each a new review v2 New
ads_management for ad rules, a new Meta review v4 New

How we do it

  1. Watch hello@joinsquareup.com for Shopify and Meta reviewer emails; answer the same day.
  2. Before adding any scope, write the reason here, record a new screencast and resubmit; never ship a scope the review has not approved.
  3. Record every screencast on Cozy Snugglet, never on Arata.
  4. After Shopify approves:
# in tools/prod-env.sh, then promote
SHOPIFY_OAUTH=1 SHOPIFY_INSTALL_URL=<the listing link>
  1. Repoint the Shopify app's URLs to feed.joinsquareup.com with the Shopify CLI from ~/Documents/ChatGPT/_shopify-brew-app, then shopify app deploy.

Numbers

Metric Definition Where measured Status
Reviews open Platform reviews submitted and not decided This page 3 on 26 Oct: Shopify, Meta verification, Google Ads Basic
Days in review Days since each submission This page Shopify 5, Meta verification 10 on 26 Oct
Scopes beyond read Write scopes granted This page 0

Open

  1. Meta verification has been in review 10 days. Chase it? Proposal: open a support case in Business Help if it is still in review on 30 Oct.
  2. Move the Shopify app's URLs to production before approval? Proposal: no, change nothing during review; move them the day it is approved.
  3. Point Meta's privacy URL at production now? Proposal: yes, feed.joinsquareup.com/privacy, since the page is the same and production is the brands' home.
Sources
  • brew/docs/shopify-app-review.md:3-40, 89-93
  • brew/docs/shopify.app.toml:1-35
  • brew/docs/connectors-approvals.md:1-47
  • brew/docs/production.md:117-127
  • brew/tools/prod-env.sh:9
  • brew/shopify-app.js:15-19, 30, 203-217
  • memory brew-shopify-app-review, brew-meta-app-review, brew-google-oauth-scopes, brew-real-connectors, never-disconnect-arata-meta
  • handbook content/engineering/connectors.md, content/integrations-and-ecosystem/meta.md

Source file content/security-privacy-and-legal/platform-compliance.md · For agents: Markdown · JSON