About this bot

Requests signed with the key published here come from a small research tool that reads public store pages. It sends one of these user agents:

• KeptuShopifyCheck/0.1 checks whether a store runs on Shopify: robots.txt, the homepage and /products.json?limit=1, and the site icon its homepage names.
• KeptuResearch/0.1 reads a store once a week: its public product list (/products.json, or the sitemap and product pages), the homepage, and the shipping and returns pages. It renders the homepage once, with JavaScript off, from those same requests.

How it behaves

• It reads robots.txt first and obeys it.
• One request every 3 seconds at most, and at most one pass per store per day.
• It stops for the day on 401, 403, 429, 430 or any challenge, and honours Retry-After. It never solves a CAPTCHA, uses a proxy or rotates IP addresses.
• It never logs in and never touches a cart, checkout or account.
• It keeps store facts only: titles, prices, availability, dates and image addresses, plus the homepage's offer lines, the policy pages' text and one homepage screenshot a week. Besides those screenshots, the one file it keeps is the small site icon, once per store.

How to opt out

Add this to your robots.txt. The tool reads it on every run, so the change applies from its next visit.

User-agent: KeptuShopifyCheck
Disallow: /

User-agent: KeptuResearch
Disallow: /

To ask a question or have a store excluded without editing robots.txt, write to {bot_contact}.

Checking a request

Each request carries Signature, Signature-Input and Signature-Agent headers (Web Bot Auth: RFC 9421 HTTP Message Signatures, Ed25519). The public key is at /.well-known/http-message-signatures-directory.