How My Woo Stores Handles Your Store Credentials

A WooCommerce REST API consumer key and consumer secret. That is the whole requirement for the dashboard, orders and products.

Your WordPress administrator password is never requested and never stored. There is no account to create with My Woo Stores either — no email, no password, no profile. The app is a client for your store, not a service you sign up to.

One exception, and it is worth knowing before you meet it: uploading product images additionally needs a WordPress application password. The WooCommerce REST API can write products but not media — that is a WordPress boundary, not a choice the app made. The app asks for it the first time you save an image, and an application password is revocable from your WordPress profile independently of everything else.

On your device, in the platform’s secure credential store — the iOS Keychain or the Android Keystore. Not in app preferences, not in a plain file, not in a database the app can read casually.

That is the same mechanism your device uses for saved passwords, and it means credentials are protected by the device’s own encryption and unlock.

Yes — and this is the part usually left out. Some connection metadata, including credentials in encrypted form, is transmitted to and stored on our servers, because push notifications require it. A notification about a new order has to be triggered by something that is watching your store while your phone is asleep, and that something cannot be your phone.

So the accurate statement is not “nothing ever leaves your device”. It is: your credentials are held on your device in the keychain, and the encrypted subset needed for server-side features is held on our servers under TLS in transit and encryption at rest. The privacy policy says the same thing in the same words, because a security page that disagrees with the legal document is not a security page.

Everything else — every dashboard figure, every order, every product edit — goes straight from your device to your store over HTTPS. Your sales data is not routed through, copied to, or stored on our infrastructure.

One-click OAuthis the recommended route. The app opens your store’s own authorisation page, you approve access as a logged-in administrator, and WooCommerce hands back a key pair. You never copy or paste a secret, and the approval happens on your store, under your control.

Manual API keys is the fallback. Generate a key under WooCommerce → Settings → Advanced → REST API and paste the consumer key and secret into the app. This is the route to use when a security plugin blocks the OAuth handshake, which is common and is not a sign that anything is wrong.

Manual keys have one real advantage: you choose the permission level. If you only want to watch numbers, create a Read key and the app cannot change anything in your store even if it wanted to.

From WordPress, without involving this app at all. Delete the key under WooCommerce → Settings → Advanced → REST API, or revoke the application password from your WordPress user profile. Access stops immediately.

This matters more than it sounds. The ability to cut off a third-party integration without needing that third party’s cooperation is the whole point of API keys, and it means the honest answer to “what if I stop trusting this app?” is: you do not have to ask us for anything.

Disconnecting a store inside the app removes its credentials from the device, and deleting your data is a request the privacy policy commits to fulfilling within 30 days.

The keychain is protected by your device’s unlock, so a locked phone does not surrender them. A device with no passcode is a different situation, and no app can fix that from the inside — which is why the recommendations below start where they do.

• Use a device passcode and biometrics — local credential storage is only as strong as the device holding it
• Do not run the app on a jailbroken or rooted device
• Give the API key Read/Write only if you intend to edit; Read is enough for dashboards
• Rotate your WooCommerce API keys periodically
• Revoke a key immediately if a device is lost, and revoke it from WordPress rather than from the app

If a device is lost, revoke the key in WordPress. That is faster and more certain than anything done from the app, and it works even if the device is already in someone else’s hands.

No. Your orders, revenue figures and product data are not sold, traded, rented, or used to train anything. There is no data brokerage in the business model — the app is funded by ads on the Free tier and by subscriptions.

The AI features are the one place text leaves the app deliberately: a description you ask to rewrite is sent to the AI provider (Groq) to be rewritten, and Voice Input audio is transcribed by Apple’s or Google’s platform speech service and then discarded. Both are opt-in per action, on a paid tier, and named explicitly in the privacy policy. More on the AI features.

The model suits it well: a client generates an API key, you connect with it, and the client can revoke it themselves at any time without asking you. You are not asking them to trust a third-party service with their store — you are asking them to use the same key mechanism they already use for every other integration.

Be aware of the limit: credentials are per-device and there are no team accounts, so each person who needs access connects their own device with their own key. More detail for agencies.

No system is absolutely secure, and the terms say so rather than implying otherwise. Locally stored credentials are exactly as safe as the device holding them; a jailbroken or rooted device substantially weakens that. Keeping WordPress, WooCommerce and your plugins patched is your side of the arrangement, and it is the side most store compromises actually come through.

What is promised is narrower and checkable: no admin password is asked for, credentials are in the platform keychain, store traffic is direct over HTTPS, sales data is not stored on our servers, and access is revocable by you at any time from WordPress.