What data Hype can access

Hype Upsell asks for four permissions — fewer than any other Hype app except the cart drawer. Below is that list in plain words, with what each one is actually used for. If a permission is not on this list, Hype Upsell cannot use it, whatever any screen inside the app appears to offer.

What Hype Upsell can change

Permission	What it lets the app do	Why it needs it
Discounts	Create and edit discounts	An upsell's price is applied as a real Shopify discount, so the customer pays the offer price and not the list price.
Order editing	Add a product to an order that already exists	This is the thank-you page Add flow: the customer has already paid, so the product is added to their existing order and any balance is collected separately.

Order editing is the unusual one, and it is the whole point of a post-purchase upsell. It lets Hype Upsell add the item the customer accepted, and its discount, to the order they just placed. It is used on orders where a customer accepts one of your offers.

What Hype Upsell can read

Permission	What it can read	Why
Products	Products, variants and collections	So you can pick what to offer, and so the offer shows the right variant and price.
Orders	Orders, including the one being upsold	To build the offer for the order in front of the customer — the items in it, the currency, the payment details needed to collect a balance — and to count paid orders for billing and measure which offers were accepted.

Orders are protected customer data under Shopify's rules, so this permission is reviewed and approved by Shopify before the app is allowed to request it.

What Hype Upsell cannot do

It cannot read or change anything not on the lists above. In particular it cannot:

Take payments, issue refunds, or see card or payment details. The extra payment for an accepted upsell is collected by Shopify, on Shopify's own page, not by Hype.
Create, edit or delete your products.
Read your customers or customer segments, your Markets, your languages or your themes. Hype Upsell has no theme app embed and never touches your theme.
Read your Shopify staff accounts or their passwords.
Change your store's settings, plan or domain.
Access other apps' data.

It also cannot see which member of your staff is using it. Hype identifies your store, not the individual signed in, which is why an in-app support conversation belongs to the store rather than to a person.

The checkout surfaces

The offers themselves render inside Shopify's checkout, thank-you and post-purchase pages. Shopify runs those in a sandbox with its own rules: an extension there gets only the data Shopify hands it for that order, and it cannot reach the rest of your store. Selecting Hype as your post-purchase app under Settings → Checkout is what allows it to render there at all, and you can change that selection at any time.

Where the data goes

Your configuration — upsells, targeting rules, offer text — is stored by Hype so the app works.
Order events are used to attribute accepted offers to revenue and to count paid orders for billing.
Nothing is sold to anyone, and nothing is shared with other merchants.

Why the permission screen appeared again

Shopify asks you to re-approve whenever an app's permission list changes — including when it is reduced. A re-consent prompt is not by itself a sign that the app is asking for more.

Removing access

Uninstalling Hype Upsell from Apps in your Shopify admin revokes every permission immediately. Your Hype configuration is deleted with it — see Uninstalling Hype.