Question 1

How long does setup take?

Accepted Answer

Under ten minutes for most stores. Install from the Shopify App Store, approve a plan, turn on the app embed in the theme editor, set your rules, and style the modal. There is nothing to configure on any external site.

Question 2

Do I need a developer or theme code?

Accepted Answer

No. Verification runs through Shopify's app embed block, so it works on the product page, cart page and cart drawer without a single line of theme code. Rules, fees and modal styling are all set from the dashboard.

Question 3

Why do I have to approve a plan before OTPs send?

Accepted Answer

Messages are billed through Shopify, and usage records need a subscription line item to attach to. Every plan — including Free — is a real $0-or-more Shopify subscription. Until one is approved, the send-OTP endpoint returns an error and no message goes out.

Question 4

Will CODGuard work with my theme?

Accepted Answer

Yes. The modal is a neutral, fully themeable overlay — you control colours, radius, shadow, typography and every line of copy, with a live preview. It is built on a warm-neutral palette precisely so one modal can sit convincingly on thousands of different themes.

Question 5

How are OTPs delivered?

Accepted Answer

Through the Meta WhatsApp Cloud API, with SMS available as an alternative or a fallback. Every credential is held server-side; nothing sensitive is ever exposed to the storefront.

Question 6

What happens if a customer never verifies?

Accepted Answer

They cannot place a COD order. They can still pay prepaid, or leave — which is the point. An unverified COD order is the one most likely to come back to you.

Question 7

Can returning customers skip verification?

Accepted Answer

Yes. Turn on skip-for-returning and any phone number that has already cleared an OTP goes straight through. Your best repeat buyers should not be slowed down by a check written for strangers.

Question 8

What stops someone spamming the OTP endpoint?

Accepted Answer

Each number is limited to three sends per ten-minute window by default, with a configurable resend cooldown. Wrong codes are counted separately and lock out after the same number of attempts. Codes expire after ten minutes and are stored only as SHA-256 hashes.

Question 9

Can I block COD for specific pincodes?

Accepted Answer

Yes. Business rules let you block by pincode, cap COD above a cart value, and exclude individual products or whole collections. Rules run in priority order and each one can block or allow, so exceptions are easy to carve out.

Question 10

Will CODGuard slow down my checkout?

Accepted Answer

No. The modal script loads asynchronously and never blocks the page. Shopify's own checkout is untouched — verification happens before the customer ever reaches it.

Question 11

How is the RTO risk score calculated?

Accepted Answer

Address quality, order history and behavioural signals combine into a 0–100 score and a LOW / MEDIUM / HIGH / CRITICAL band. The full signal breakdown is stored with the order, so you can always see which signals fired.

Question 12

Does hiding COD break Shopify's checkout rules?

Accepted Answer

No. COD is hidden through Shopify's official payment customization function. The delivery customization is deliberately written never to hide the cheapest option for a COD order — buyers always keep the cheapest choice and see any COD charge as a separate, clearly labelled one.

Question 13

Why does my invoice show US dollars?

Accepted Answer

Shopify bills all apps in USD and pays developers in USD; app-store pricing cannot be listed in any other currency. Rupee amounts in the app are converted at a fixed reference rate so you can reason about cost, and the exact dollar figure Shopify charges is always shown beside them.

Question 14

What am I actually charged for?

Accepted Answer

Your plan's monthly fee, plus the messages CODGuard delivers on your behalf: OTPs, abandoned-checkout nudges and address-update requests. COD and partial orders carry no per-order fee.

Question 15

What happens to my rate if I change plans?

Accepted Answer

New messages bill at the new plan's rate from the moment the change takes effect. Messages already sent keep the rate they were billed at — every message stores its own rate, so your history stays accurate.

Question 16

Is customer data stored securely?

Accepted Answer

Phone numbers are stored encrypted at rest and masked everywhere in the merchant admin. All messaging and API credentials live server-side as environment variables. Authentication uses Shopify session tokens through App Bridge.

Question 17

Is CODGuard GDPR compliant?

Accepted Answer

Yes. CODGuard honours all three of Shopify's mandatory compliance webhooks — customer data request, customer redact and shop redact — and cleans up shop data on uninstall.

Question 18

What data does CODGuard need access to?

Accepted Answer

Orders, customers and themes for read; discounts, draft orders, order edits, products, inventory, and payment and delivery customizations for write. Every scope maps to a feature you can point at: nothing is requested speculatively.

Questions, answered
without the hedging.

Getting started

Verification & OTP

Rules, risk & checkout

Billing

Data & security

Still deciding?