It's a reasonable thing to pause on — you're about to give something access to your store's data, and it's worth knowing exactly what that means before you do it. The short answer is that a well-built counter connection is quite limited in what it can do, but "well-built" is doing some work in that sentence, so it's worth understanding why.
What a counter app actually needs access to
To show your order count or revenue, an app only needs to read your orders — it doesn't need to see your customer's personal details beyond what's already tied to an order, doesn't need access to your products, your theme, your payment settings, or anything else in your store.
This is controlled by something called a permission scope. When you install a Shopify app, it requests specific scopes — for a counter app, that should be something like "read orders" and nothing more. It cannot request broader access without you seeing that request during installation.
What "read-only" actually means in practice
A read-only scope means the app can look at your order data, but it has no ability to create, edit, or delete anything in your store. It can't change prices, can't cancel orders, can't modify customer records, and can't touch your storefront or theme. Even if there were a bug in the app's own code, the permission boundary itself prevents it from writing anything back to your store — it simply doesn't have the access to do so.
How to check what an app can actually do before installing
Before you approve any Shopify app, you'll see a permissions screen listing exactly what it's asking for. It's worth actually reading this rather than clicking through — if a physical counter app is asking for access to your customer list, your payment details, or write access to orders, that's worth questioning, since none of that is needed to display a number.
Flipcounter requests read-only access to orders, refunds, and cancellations — nothing else. That's the minimum needed to calculate an accurate count or revenue total, and nothing more.
What about the physical counter itself?
The Smiirl device only ever receives a number from a URL you provide — it has no connection back into your Shopify store, and no way to affect it. All the security consideration lives on the software side, in whatever generates the JSON your counter reads.
If you're building the connection yourself
The same principle applies if you're writing your own feed: only request the Shopify API scopes you actually need (orders, read-only), and be cautious about where you host the credentials that connect to your store — a webhook secret or access token sitting in an insecure or public place is a bigger risk than the app itself.
Once you're comfortable with the access side, here's how the actual connection works.