Audit report
Calculator Builder
Broad accessReach : moderateSensitive Accessby Calconic · Store design · Shopify App Store
Build and add a custom interactive calculator to your store
Key insights
- ◆Calconic Calculator Builder is a calculator/widget app published by MB LUMIUS (brand: CALCONIC_), 4.4 stars / 19 reviews, live since 2017.
- ◆Permissions are mostly read-only PII + storefront script_tags; no write_orders/write_customers/write_products requested.
- ◆Privacy policy exists and references GDPR + CCPA but lacks SOC 2 / ISO 27001 / PCI / HIPAA attestations and a complete sub-processor list.
- ◆No public CVEs, breaches, or security incidents found for Calconic/MB LUMIUS or this app.
Top findings
Analysis summary
Build and add a custom interactive calculator to your store
- ◆Calconic Calculator Builder is a calculator/widget app published by MB LUMIUS (brand: CALCONIC_), 4.4 stars / 19 reviews, live since 2017.
- ◆Permissions are mostly read-only PII + storefront script_tags; no write_orders/write_customers/write_products requested.
- ◆Privacy policy exists and references GDPR + CCPA but lacks SOC 2 / ISO 27001 / PCI / HIPAA attestations and a complete sub-processor list.
- ◆No public CVEs, breaches, or security incidents found for Calconic/MB LUMIUS or this app.
- ◆Publisher domain (calconic.com) serves HTTPS but lacks HSTS and CSP; runs Apache 2.4.52 on Ubuntu.
- ◆No evidence of LLM/AI use; product is a deterministic formula/calculator builder.
This section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedOAuth scopes requested
These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.
| Scope | Sensitivity | Why we flag it |
|---|---|---|
read_products | Low | Needed to surface product data inside calculator forms. |
read_orders | Medium | 60-day order history access exposes customer PII and purchase patterns; should be limited to what calculator analytics require. |
read_locations | Low | Location data used for multi-location pricing logic. |
read_script_tags / write_script_tags | Medium | Inserting/managing script_tags on Online Store expands third-party JS execution surface on storefronts. |
read_store_information | Medium | Pulls store owner name, email and phone, merchant PII handed to a third party. |
device/activity (IP, geo, browser) | Low | Telemetry on widget end-users; standard for analytics but should be disclosed clearly. |
read_productsNeeded to surface product data inside calculator forms.
read_orders60-day order history access exposes customer PII and purchase patterns; should be limited to what calculator analytics require.
read_locationsLocation data used for multi-location pricing logic.
read_script_tags / write_script_tagsInserting/managing script_tags on Online Store expands third-party JS execution surface on storefronts.
read_store_informationPulls store owner name, email and phone, merchant PII handed to a third party.
device/activity (IP, geo, browser)Telemetry on widget end-users; standard for analytics but should be disclosed clearly.
This section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedThis section is available to signed-in users
Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.
Get startedNetwork surface
- Primary domain
- calconic.com
- TLS grade
- unknown
- HSTS
- Missing
- CSP
- Missing
HTTPS reachable with X-Frame-Options: DENY but no HSTS, no CSP, server header reveals Apache/2.4.52 (Ubuntu).
Compliance & certifications
GDPR and CCPA referenced; no SOC 2 / ISO 27001 / PCI DSS / HIPAA certifications disclosed. Retention up to 10 years post-service for service-related data.
Privacy policyPublisher reputation
- Publisher
- Calconic
- Verified Shopify Partner
- No
- Years active
- 9
- Other apps
- 0