lamapixel
0%
E-commerce · 8 min read

App audit: what apps take from you even after uninstalling

An uninstalled app stays in the theme: 6.9 MB of images, dead snippets and third-party scripts without defer. How to audit your apps yourself, with commands.

App audit: what apps take from you even after uninstalling

The "Uninstall" button in the Shopify admin cancels the subscription and disconnects the app from the store. It does not delete what the app uploaded into your theme. Images, snippets, layout edits and links to third-party servers stay there until somebody finds them by hand.

In one store we have managed long term we found 6.9 MB out of an 8.8 MB assets/ folder that way - images belonging to a loyalty app that had been uninstalled long before. Three snippets referenced them and not one of them rendered (our own analysis of a local copy of the theme, 27 August 2026).

You pay for apps monthly, but the bill has three parts

The first part is the subscription and you see it on your statement. The second and third are not billed in money, but they get paid all the same.

Part of the bill Where it shows up When it ends
Subscription account statement on uninstall
Page slowdown LCP, number of requests only when the theme is cleaned
Developer time every further edit only when the theme is cleaned

Subscription costs are covered in the article on the monthly running costs of a store. This text is about the other two.

An app does not touch only its own files

To work in the product listing or in the cart, an app has to get into the theme. It does that in six ways, and each of them survives an uninstall for a different length of time:

  • Files in the assets/ folder - images, scripts, styles.
  • Snippets that it inserts into sections or into the layout.
  • Edits to layout/theme.liquid - initialisation, tracking code.
  • Script tags inserted by the platform outside the theme.
  • App proxy - its own URLs under your store's domain.
  • A custom layout, typically with page builders.

On uninstall the platform reliably cleans up only script tags and app blocks. The rest is your file in your theme and no outsider is going to delete it.

Dead images do not slow the page down, but they make every job on the theme more expensive

The 6.9 MB of images from the opening are never loaded, because the snippets that call them do not render anywhere. A visitor never downloads them and you will not find them in a speed measurement.

They do make everything else more expensive though: downloading the theme, duplicating it, deploying with theme push, comparing two stores. Exactly the operations a developer performs on every order. Measure the assets/ folder before you start dealing with the size of the theme - otherwise you are optimising code whose share is smaller than the share of dead images.

In the same theme there were also 31 unused snippets out of 102, 34 unused sections out of 149 and 15 dead files in assets/ totalling 312 kB.

The theme's own code was 635 kB, on the live page there were three megabytes

This is the clearest number in the whole analysis. Of custom scripts the theme had 32 files totalling 635 kB and all of them were attached with the defer attribute. On the live page, meanwhile, the measurement tool counted roughly 3 MB of JavaScript in 236 files (WebPageTest, mobile profile, cold cache, 24 June 2026).

Apps and third-party services brought the difference. Anyone who pays for a theme refactor in that situation and skips the app inventory is buying roughly a fifth of the problem. How speed splits between the platform and the page is covered in the article on why a fast Shopify is slow.

Twelve third-party scripts without defer are twelve outages waiting to happen

In the same theme we counted 12 external scripts without a defer or async attribute from seven third-party hosts. Two of them were synchronous right in the <head>, that is, in the place where the browser stops processing the document until the file has been downloaded from someone else's server.

When that server does not answer, nothing renders. This is not a theoretical worry: one of the hosts in that theme, polyfill.io, was returning HTTP 520 when we checked it on 27 August 2026.

polyfill.io is not slow, it is third-party code with a third-party owner

With this item speed is not the issue. The polyfill.io domain changed hands in 2024 and started sending malicious redirects to a share of visits; today it is dead. It got into the theme in one app's snippet, as a fallback for old browsers.

What matters is how it gets fixed. That snippet is a vendor file and carries a "do not edit manually" note - any fix disappears with the app's first update. The question therefore goes to the app's developer, not to your programmer. If the app is no longer installed, the snippet is deleted whole.

In practice this means one thing: every theme you take over from somebody else gets searched for third-party domains in <script src> before it goes to production.

Apps print the customer's email into the HTML and session recorders collect it

A typical initialisation snippet of a loyalty or referral app prints customer.email, first_name, last_name, orders_count and total_spent into the page. Some apps additionally duplicate the email into data attributes.

Taken separately, each of those steps is lawful. The problem arises at the intersection: a session recorder was running on the same page. Personal data printed into the HTML thereby ends up in a session recording held by a third party, and that is a transfer that has to be documented.

This is not a finding for a developer but for whoever is responsible for personal data processing at your company. Our role ends with the sentence "this is what the page looks like and these three services can see it".

Page builders leave behind a second layout nobody knows about

Page builders such as GemPages, PageFly or Shogun add their own layout/theme.<name>.liquid. After an uninstall the file stays and it contains a copy of the head with all the edits made at that time.

In the theme we analysed it had 583 lines and no {% layout %} called it. It differed from the live layout in 165 lines - and it contained the only call to the hreflang snippet in the entire theme.

Before you delete such a file, compare it with the live one. The differences show which edits to the head were made blind over the years and what was lost along the way.

You can audit your apps yourself in an afternoon

Download the theme through the Shopify CLI and run five checks on the folder. Not one of them needs admin access.

du -sh assets/                                   # how much the static files weigh
rg -o 'src="https?://[^/"]+' --no-filename | sort -u   # third-party domains in scripts
rg -l 'polyfill\.io|cdn\.jsdelivr|unpkg\.com'    # known third-party CDNs
ls layout/                                       # we expect one theme.liquid
rg -c 'customer\.email|customer\.total_spent'    # personal data in the HTML

Every finding then comes with one question: does anything still call this file? A snippet name is searched for in render and include, an asset name across the whole theme. When it is found nowhere, it is a candidate for deletion - not the deletion itself, because the decision belongs to whoever knows what that feature used to earn.

What the clean-up costs you

Let us say it plainly, because offers to speed a site up usually leave this sentence out. Uninstalling an app loses you a feature you were paying for - a loyalty programme, product reviews, the upsell in the cart.

The decision therefore does not belong to a developer but to whoever knows the revenue of that feature. We supply the other half of the equation: what that app costs in megabytes, in seconds, in the risk of an outage and in developer time.

The second thing it is fair to say: a theme clean-up is invisible. It adds no feature and moves no design. It pays for itself at the next edit, which is done in half the time, because it is clear what is alive.

Send us your app list and the store address

We will return which of them actually run, what the uninstalled ones left behind in the theme and which third-party scripts load on every page. For each item we will state what happens if it is removed.

The scope of a site audit and speed-up is described on the service page; if you are dealing with the whole theme and not only the apps, look at how templates get out of hand. We also build stores on Shopify - including taking one over from another supplier.

Write to info@lamapixel.com or call +420 775 599 009.

Need a hand?

Write to us and we'll figure it out together.

Book a consultation →