Changelog · 22 July 2026

One acquisition ID from landing page to paid event.

Marlo now provides an origin-restricted browser key, a separate private server credential and a verification view for Shopify app acquisition and lifecycle events.

What shipped

  1. 01Versioned hosted JavaScript with no private credential
  2. 02UTM, referral and Google click identifier capture
  3. 03First-party opaque acquisition ID
  4. 04Explicit browser events marked as non-authoritative
  5. 05Server-only install, trial, paid, cancellation, churn and refund events
  6. 06Exact-origin restriction, deduplication and rate limiting
  7. 07Recent verification events and 180-day raw retention
  8. 08Public-key and private-key rotation plus revocation

Honest Shopify handoff

Marlo does not assume query parameters survive the App Store, Shopify-managed installation or an OAuth redirect. App developers retain the opaque ID in their own signed session and associate it only after Shopify authentication succeeds. Marlo never replaces the OAuth state/nonce.

Set it up

Follow the acquisition tracking setup guide for browser, Shopify Remix, Next.js and direct HTTP examples.

Use the method on your own data

Marlo keeps definitions beside the relevant report and detail views.

Start 7-day trial