We made it smaller on purpose.

Letting an app near your checkout is a hard ask. The wrong one fakes orders, or breaks something you won't see until a shopper does. So here is what we build, what we deliberately don't, and where this thing's edges are.

Why the product shrank

The earlier version of BopiSafe was built around a real gap: a cart holding a pickup-only item next to a ship-only one had no single delivery method that fit, so it couldn't check out. We spent months on that problem and shipped a good answer to it.

Then Shopify shipped its own. Native checkout now splits a mixed cart itself, and that rollout keeps widening. A sensible response to the platform absorbing half your product is not to compete with it — it's to delete that half. So we did: the cart splitter, the per-product method rules, the enforcement functions, the whole policy engine behind them. All gone.

What's left is what native still doesn't do, and shows no sign of doing: tell a shopper how many units each of your stores actually has, and let them book a time to collect. That's a smaller product. It is also the part shoppers actually touch.

The one rule

Ride the platform, don't replace it. Every order BopiSafe touches is Shopify's own native pickup order — not a draft order, not a shipping order with a pickup tag stuck on it. Shopify splits the mixed cart; Shopify sends the "Ready for pickup" email; Shopify hands off to POS; Shopify's inventory stays the single source of truth. We add a layer in front of checkout and get out of the way.

The rule has teeth in it. It's why we don't enforce fulfillment methods, don't touch your theme's markup, don't build our own notifications, and don't keep a database of your settings — hours, slots and capacity live in metafields on your own shop, where you can read them with the Shopify API long after we're gone.

It's also why the one checkout customization we install can only hide things. It hides pickup stores the shopper didn't choose, and slots that have filled up. There is no code path anywhere in the app that stops a shopper with an error message.

Where the edges are

Underclaiming is how a checkout app earns trust, so here's the honest list of what BopiSafe does not do:

• One pickup store per order. Shopify binds a single pickup location to an order, and we don't work around it. If a cart's items sit in different shops, the picker helps the shopper find the one shop that has all of it — it won't split the pickup across two.
• No local delivery. Pickup only. Delivery needs address-to-store matching, delivery windows and its own capacity model; bolting a thin version of that onto a pickup app helps nobody.
• Capacity is soft. A full slot disappears from the calendar and from checkout, but a shopper sitting on a stale page can still slip one extra booking through. That's the deliberate trade: we would rather your team absorbs the odd extra collection than have a real shopper hit an error at checkout.
• Stock is fresh, not instantaneous. The count comes live from your inventory and is cached for about half a minute, so worst case a shopper sees a number a minute or so old. If we can't reach Shopify at all we show nothing rather than a wrong "out of stock".
• No analytics dashboard, no SMS, no pick lists. Shopify's own reports and notifications already cover the first two; back-of-house picking is a different product.

Why so much of it is free

In this category, multiple locations and live per-store stock are almost always the paywall — the two things you have to upgrade for. We put both in the free plan, at any number of stores, and bill on volume instead: 100 pickup orders a month included, $19.90 a month when you outgrow that.

We know exactly what that is. It's a bet that a store which grows on the free plan will happily pay when the free plan runs out, and that being the app that doesn't nickel-and-dime a second location is worth more than the upgrades it forgoes. A competitor can match it tomorrow. We'd rather make that bet than launch with the good part locked.

And when you do run out, nothing switches off. The allowance decides your bill, not whether your storefront works.

How we work

We're a small team based in China, building for Shopify merchants worldwide. This is the third rebuild of the same idea, and each one got narrower.

We read every email and answer within a day. The app installs with nothing to fill in — it reads your Shopify locations, puts sensible hours in place, and works before you've configured anything. If your theme does something unusual, tell us and we'll look at your actual store rather than sending you a docs link.

Who builds BopiSafe

BopiSafe is built by Oriorn, an independent research studio for Shopify retail experience — it studies how real multi-location stores sell, and builds the fixes worth building. The thinking lives at oriorn.com.