PlukioBot

Plukio is a marketplace directory that helps shoppers discover independent Shopify shops. PlukioBot is our crawler. It identifies itself with the User-Agent:

PlukioBot/1.1 (+https://plukio.com/bot)

How to verify it is really us

A User-Agent string is just a claim — anyone can type ours. So PlukioBot also cryptographically signs every request it makes to your shop, using Web Bot Auth (Ed25519 signatures over RFC 9421 HTTP Message Signatures). Cloudflare and Shopify check these at their edge.

Every request carries three headers — Signature-Agent, Signature-Input and Signature. To check one yourself, fetch our public key directory:

https://plukio.com/.well-known/http-message-signatures-directory

Then find the key whose thumbprint matches the keyid in our Signature-Input header. Ours is currently:

v_ZmBOv9xRvJCOHQGhC9GZW74fAFZqF_ADjYXwTqqIw

There is also a machine-readable summary of all of this at /.well-known/signature-agent-card .

Nothing changes if you don't verify us. Your robots.txt still governs what we fetch, Crawl-delay is still honored, and the opt-out below works exactly the same. Signing is there so that our honesty is something you can check rather than something you have to take our word for.

What it fetches

Your public product listing data and sitemap
Your homepage, to read your shop's name and description
Your robots.txt, which it always honors (including Crawl-delay)

It fetches politely (rate-limited, spaced requests), never places orders, never reads customer data, and your content is never used to train AI models. Buyers who find your items on Plukio are sent to your storefront to purchase.

If your shop is you: a data protection note

Plenty of the shops we index are one person. When that is true, information about the shop — its name, description, location, and the domain it trades under — can also be information about you, and data protection law in the EU, the UK, and elsewhere gives you rights over it. We did not get any of it from you, so here is the notice you are owed.

Where it came from: your shop's own public website — the same pages you serve to any shopper or search engine. Never from Shopify, never from an app, never from a data broker.
What we hold: your shop's public profile and catalog listings, and records of clicks Plukio sent you. Never orders, customers, or payouts — we have no way to reach those.
Why: our legitimate interest in running a search engine that helps people find independent shops, weighed against your interest in controlling information about you. The opt-out below is how we keep that balance honest: if you object, we act on it, and you do not have to explain why.
Who is responsible: Howdoicomputer, LLC, the controller of this data. Our Privacy Policy covers your rights of access, correction, erasure, restriction, portability, and objection, and how to complain to your data protection authority.

How to opt out

Add this to your robots.txt (Shopify: Online Store → edit robots.txt.liquid) — PlukioBot stops crawling and your shop is removed from the index automatically:
```
User-agent: PlukioBot
Disallow: /
```
Or email [email protected] from your shop's domain and we'll remove it by hand — no questions asked.

Either route is also how you exercise a right to object or to erasure — neither needs an account, and neither needs you to say which law you are invoking.

We have no app

There is no Plukio app to install, on Shopify or anywhere else, and there is no account for us to connect to. Everything above describes the only way we ever get your data: PlukioBot reads the pages your shop already serves to the public, the same ones a shopper or a search engine would see.

That means we never see your orders, your customers, or your payouts — not because we promise not to look, but because nothing we do could reach them.

Shop owner? Claim your shop to control crawl cadence, hide items, message shoppers, and see click analytics.