Help · Audience

Verified identity

Every profile carries one of two marks:

Verified identity — this came from your store's own records, or your store has since confirmed it.
Not confirmed yet — somebody typed this address somewhere, and nothing from your store has backed it up.

This is not consent. Verified identity is about whether the person is real and yours. Consent is about whether they want to hear from you. A profile can have a verified identity and still not be subscribed, and that is ordinary. The two facts sit apart on every screen for exactly this reason.

How a profile is born

A profile is born confirmed when it comes from your store itself, or from one of your own forms whose address check passes. Anything claimed from somewhere else starts Not confirmed yet.

Confirmed from the start — anything that comes from your store itself: an order, a checkout, a customer record. Your store is the authority on who your customers are, so what it tells the app is taken as true. At checkout, your storefront often sees the address a moment before your store's own record of the checkout arrives. When that happens the profile reads Not confirmed yet for those few seconds, and is confirmed as soon as the record lands.

Confirmed straight away, from one of your own forms — when somebody fills in a signup form on your storefront, the address is checked at that moment: that the mailbox really exists, that it is not a throwaway domain, and that a real person browsing your store is behind it. An address that passes is confirmed immediately, and you can email them straight away — no confirmation email, no waiting for them to buy something. The welcome offer arrives while they are still on the page they signed up from.

Not confirmed yet — anything claimed from somewhere else: an address your storefront saw at checkout before your store's record of that checkout arrived, a profile pushed in through the events API, or a form signup where the check could not confirm the address. Anyone can type any address into a form, so until something backs it up, it is a claim.

The person is still accepted and thanked like everybody else, and their consent is recorded. They are not emailed yet, and the moment they place an order they are confirmed automatically.

Sometimes the check cannot confirm an address — the mailbox does not answer, or the checking service is briefly unavailable. When that happens:

The person is accepted and thanked exactly like everybody else. They are never told their own address looks wrong, and they never see a different screen. Turning a real customer away at the moment they were about to buy from you is the worst thing this could do, so it does not do it.
Their consent is real and is recorded. They asked to hear from you, and that is true whatever the check said.
The person is not emailed yet — and the moment they place an order, they are confirmed automatically, with nothing for you to do.

Being unconfirmed is never a doubt about their consent. It is a question about the address, and the two are kept apart on purpose.

On the Free plan, the first 200 sign-ups each billing period are checked. Past 200, the person is accepted, thanked and their consent recorded exactly as above, and their address waits unchecked. It is checked on its own when the next billing period starts, oldest first and up to that period's 200, or all of them soon after you choose the $29 plan — and the moment they place an order they are confirmed anyway.

Catch-all domains are the one case with a setting of their own. Some domains — most work addresses — accept mail to any name at all, so the check cannot learn anything from them either way. By default, somebody on one of those domains who browsed your store before signing up is accepted and confirmed on that evidence, and the profile records that it was the browsing rather than a mailbox that vouched for them.

The switch itself is in Settings → Email, with the two numbers to keep an eye on underneath it. What it decides, what the trade is, and what "browsing" counts as are explained on the What a form collects help page, under Catch-all addresses.

How a profile becomes confirmed

The moment your store shows the app the same email address — an order, a checkout, a customer record — the profile becomes confirmed. Automatically, and usually within seconds.

It only goes one way. A profile that has been confirmed is never un-confirmed. Nothing arriving later can walk that back.

You do not have to do anything to make this happen, and there is nothing to approve. Someone who signs up on your storefront today and buys tomorrow is confirmed tomorrow.

Somebody who gave you only a phone number is confirmed by the code. When a new person signs up on a form that asks for a phone number and no email address, there is nothing from your store to back them up — so, once your text-message number is approved, they are texted a six-digit code. Typing it back proves the number is theirs, and their profile becomes confirmed. A profile that also has an email address is not confirmed this way: a code proves a phone number, never an email address.

The store owner can also confirm someone by hand. On a profile that reads Not confirmed yet, the owner's ⋮ beside it offers Confirm this person. Use it for somebody you know is a real person at that address — your founder, a long-time customer who has never ordered online. You type why, and the reason is kept on the profile: its activity feed reads "Confirmed by" your name and the reason. Confirming does not subscribe anybody; their consent still decides every email and text, and anyone who unsubscribed or whose address bounced stays that way. It cannot be undone, and only the owner can do it — not a manager, not our team, and not a connected assistant.

What unconfirmed profiles can and cannot do

Unconfirmed profiles are shown on the profiles screen, but they are not counted in any segment or email audience, never emailed, and never deleted on a guess.

They are shown. They appear in the profiles screen with their mark, and you can open them and read everything the app knows about them. Hiding them would make your audience smaller than your store's own customer records with no explanation on any screen.

They are not counted. They are excluded from every segment, every count, and every email audience. A text campaign's audience is the exception, below.

They are never emailed. No email you send through this app goes to a profile that has not been confirmed.

Texts work differently. Whether somebody can be texted does not depend on this mark: it depends on a complete record of that person agreeing to your texts on the number being texted — when, where and the wording they saw. An unconfirmed profile with that record can be texted — it is in your text campaigns' audiences, and in a list's count of people who agreed to texts — and a confirmed one without it cannot.

And they are never deleted on a guess. Being unconfirmed is not an accusation — it is the absence of evidence. Deleting the record would destroy the very thing that shows whether the caution was warranted, so the profile stays, and it upgrades quietly the day your store vouches for it.

Why this protects you

Holding back unconfirmed addresses protects you from automated signups, from typos and from damage to your deliverability — without asking honest people to confirm by email.

Automated traffic. Public signup surfaces get hit by scripts that inject addresses which belong to nobody, or to somebody who never asked. On your sign-up forms, those addresses do not pass the check, so they land as claims — they never reach an audience and never receive a send. A bot that fills in your checkout instead arrives confirmed, because your store reported it, so a different check holds it: nobody gets your marketing while a checkout your store reported for them shows the signs of a bot and they were new to you at that checkout. Any one of four things lets them through: an order, a Shopify tag, your storefront seeing them browse your store before a checkout, or somebody on your team marking them This is a person. This is why you do not need to make every honest customer confirm by email. The usual way to keep your audience clean is to send everyone a "click here to confirm" message, which costs you a share of every signup. Checking the address at the moment it is typed does the same job without asking anything of the people who did nothing wrong.

Typos. People mistype their own address constantly. A mistyped address cannot be corroborated by an order, so it stays out of your sends instead of bouncing off them.

Deliverability. Whether your good mail arrives at all depends on the company your mail keeps. Mail to addresses that do not exist, or that nobody asked for, is the fastest way to lose that. Refusing to send to unconfirmed addresses is the cheapest protection available, and it costs you nothing real: the people it holds back are, overwhelmingly, not people.

Where you see it

The mark shows on the profiles screen, on each profile's own page and on your home screen, and the metric charts count verified profiles only.

The Identity column on the profiles screen.
The line under the name on a profile's own page, with the date it was confirmed.
Your home screen, once your store is sending, which reports both numbers together: how many profiles are confirmed and subscribed, and under it how many are not confirmed yet. The second number never hides inside another one.
The metric charts, which count profiles with a verified identity only — the same profiles your segments are built from.