{
 "id": "9.7",
 "title": "Platform compliance",
 "department": "Security, privacy and legal",
 "department_slug": "security-privacy-and-legal",
 "direction": null,
 "branded": false,
 "status": "draft",
 "owner": "Param",
 "last_verified": "2026-10-26",
 "holds": "Shopify app review, Meta app review, Google OAuth scopes",
 "urls": {
  "html": "https://handbook.joinsquareup.com/security-privacy-and-legal/platform-compliance",
  "markdown": "https://handbook.joinsquareup.com/security-privacy-and-legal/platform-compliance.md",
  "json": "https://handbook.joinsquareup.com/security-privacy-and-legal/platform-compliance.json"
 },
 "other_directions": [],
 "tldr": {
  "headline": "Google is verified, Shopify and Meta are still waiting on reviewers",
  "points": [
   {
    "icon": "check",
    "text": "Google sign in plus Ads and GA4 were verified on 21 Oct."
   },
   {
    "icon": "clock",
    "text": "Shopify app submitted 21 Oct; Meta Business Verification has sat in review since 16 Oct."
   },
   {
    "icon": "warn",
    "text": "Meta App Review is drafted but two screencasts are missing."
   },
   {
    "icon": "lock",
    "text": "Only read scopes everywhere; a new scope means a new review."
   },
   {
    "icon": "map",
    "text": "The Shopify app and Meta privacy URLs still point at staging."
   }
  ],
  "stat": {
   "value": "3",
   "label": "platform reviews open"
  },
  "decide": "Open a Business Help case if Meta verification is still in review on 30 Oct?",
  "mood": "urgent"
 },
 "sources": [
  "brew/docs/shopify-app-review.md:3-40, 89-93",
  "brew/docs/shopify.app.toml:1-35",
  "brew/docs/connectors-approvals.md:1-47",
  "brew/docs/production.md:117-127",
  "brew/tools/prod-env.sh:9",
  "brew/shopify-app.js:15-19, 30, 203-217",
  "memory brew-shopify-app-review, brew-meta-app-review, brew-google-oauth-scopes, brew-real-connectors, never-disconnect-arata-meta",
  "handbook content/engineering/connectors.md, content/integrations-and-ecosystem/meta.md"
 ],
 "open_questions": [
  "**Meta verification has been in review 10 days. Chase it?** Proposal: open a support case in Business Help if it is still in review on 30 Oct.",
  "**Move the Shopify app's URLs to production before approval?** Proposal: no, change nothing during review; move them the day it is approved.",
  "**Point Meta's privacy URL at production now?** Proposal: yes, feed.joinsquareup.com/privacy, since the page is the same and production is the brands' home."
 ],
 "parts": {
  "Answer": "Where each platform's review stands, Shopify, Meta, Google and Slack, what each one requires of us and what must never change without a new review.",
  "Today": "| Platform | State | What it unlocks | Source |\n|---|---|---|---|\n| Google sign in and Google Ads plus GA4 | Verified 21 Oct for `adwords` and `analytics.readonly`, plus openid, email, profile | One click connect with no unverified warning | [src: memory brew-google-oauth-scopes] |\n| Google Ads developer token | Basic access applied for on 16 Oct; the token already reads real accounts | Lifts test limits | [src: brew/docs/connectors-approvals.md:19-24] |\n| Shopify public app \"Brew\" | Submitted 21 Oct, about 23:15 IST; listing limited to its direct URL | One click install for any store | [src: brew/docs/shopify-app-review.md:3-8] |\n| Shopify protected customer data | Level 1: orders and customers, no names, emails, phones or addresses | Order totals and counts | [src: brew/docs/shopify-app-review.md:18, 89-93] |\n| Meta Business Verification | Portfolio 898394269362946, Yellow Monk Technologies LLP; in review since 16 Oct, still in review on 24 Oct | Tech Provider verification, then App Review | [src: memory brew-meta-app-review] [src: memory brew-real-connectors] |\n| Meta App Review | Draft filled 24 Oct for `ads_read`, `business_management`, `public_profile` and Marketing API access tier; two screencasts missing | Meta connect for brands without a role on our app | [src: memory brew-meta-app-review] |\n| Slack app | Public distribution on; no review needed; Marketplace listing parked | Any workspace installs it | [src: brew/docs/connectors-approvals.md:15, 36] |\n| Klaviyo, Judge.me, GA4 by property | No review: pasted read only key or our service account as Viewer | Connect today | [src: brew/docs/connectors-approvals.md:6-13] |\n\n### What each review holds us to\n\n- **Shopify:** session tokens inside the admin, latest App Bridge first, install only from Shopify, GraphQL Admin API only, only the four read scopes, HMAC checked compliance webhooks, no billing while free. [src: brew/docs/shopify-app-review.md:31-40]\n- **Shopify scopes:** `read_products,read_inventory,read_orders,read_customers`; keep them in step with `connectors/shopify.js` and `shopify-app.js`. [src: brew/docs/shopify.app.toml:5, 12-15]\n- **Shopify webhooks:** data request and customer redact have nothing to send or erase; shop redact drops the store's key and numbers. [src: brew/shopify-app.js:15-19, 30, 203-217]\n- **Google:** never add a scope without a new review; never send `include_granted_scopes`; never re-run `gcloud auth application-default login` with the local client. [src: memory brew-google-oauth-scopes]\n- **Meta:** the screencast flow runs on Cozy, never Arata; never call `DELETE /me/permissions`. [src: memory brew-meta-app-review] [src: handbook content/engineering/connectors.md]\n\n### Loose ends\n\n- The Shopify app's URLs, redirects and webhooks point at staging, brew.joinsquareup.com; production waits for the review. [src: brew/docs/shopify.app.toml:8, 19-31] [src: brew/docs/production.md:125-127]\n- Production runs with `SHOPIFY_OAUTH=0`. [src: brew/tools/prod-env.sh:9]\n- Meta's privacy and data deletion URLs point at staging's `/privacy`. [src: memory brew-meta-app-review]\n- Reviewers reach the product by emailing hello@ to be added to Cozy Snugglet. [src: memory brew-meta-app-review]",
  "Tomorrow": "| Item | Version | Tag |\n|---|---|---|\n| Read only scopes on every platform | v1 | Stays |\n| Shopify app pointed at production after approval, `SHOPIFY_OAUTH=1` and the install URL | v1 | Changes |\n| Meta App Review submitted once Business Verification passes | v1 | New |\n| Built for Shopify badge: 50 paid installs, 5 reviews, Polaris, speed rules | v2 | New |\n| Write scopes for posting: Meta and Instagram publishing permissions, Shopify write scopes, each a new review | v2 | New |\n| `ads_management` for ad rules, a new Meta review | v4 | New |",
  "How we do it": "1. Watch hello@joinsquareup.com for Shopify and Meta reviewer emails; answer the same day.\n2. Before adding any scope, write the reason here, record a new screencast and resubmit; never ship a scope the review has not approved.\n3. Record every screencast on Cozy Snugglet, never on Arata.\n4. After Shopify approves:\n\n```bash\n# in tools/prod-env.sh, then promote\nSHOPIFY_OAUTH=1 SHOPIFY_INSTALL_URL=<the listing link>\n```\n\n5. Repoint the Shopify app's URLs to feed.joinsquareup.com with the Shopify CLI from `~/Documents/ChatGPT/_shopify-brew-app`, then `shopify app deploy`.",
  "Numbers": "| Metric | Definition | Where measured | Status |\n|---|---|---|---|\n| Reviews open | Platform reviews submitted and not decided | This page | 3 on 26 Oct: Shopify, Meta verification, Google Ads Basic |\n| Days in review | Days since each submission | This page | Shopify 5, Meta verification 10 on 26 Oct |\n| Scopes beyond read | Write scopes granted | This page | 0 |",
  "Open": "1. **Meta verification has been in review 10 days. Chase it?** Proposal: open a support case in Business Help if it is still in review on 30 Oct.\n2. **Move the Shopify app's URLs to production before approval?** Proposal: no, change nothing during review; move them the day it is approved.\n3. **Point Meta's privacy URL at production now?** Proposal: yes, feed.joinsquareup.com/privacy, since the page is the same and production is the brands' home."
 }
}