Paying for a Shopify build does not automatically mean you own everything in it. The question people type is who owns the code a Shopify agency writes for them, and the honest answer is: it depends entirely on which artefact you mean. Your theme, sitting in your Shopify admin, is almost always yours by default because it lives in your account. The custom app the agency built to sync your ERP? The GitHub repo with the commit history? The Figma file? The licence for the third-party filter library baked into your collection page? Those are separate things, and a standard agency contract quietly keeps several of them unless you asked otherwise in writing.
We have taken over stores from other agencies often enough to know exactly where the gaps show up. Usually nobody was being malicious. The contract was three pages long, it said "development services", and nobody thought about what happens in year three.
Ownership is not one thing, it is six
Break the build into artefacts and the question gets answerable:
- The theme code — Liquid templates, sections, CSS, JS, the theme settings JSON. It sits in your Shopify admin under Online Store > Themes.
- Custom app source code — a Node or Rails or PHP app that talks to your store over the Admin API. This lives on a server or in a repo, not in Shopify.
- The repository and history — GitHub or GitLab, including branches, issues and the deployment pipeline.
- Infrastructure — the app's hosting, database, the domain the app runs on, environment secrets, webhook endpoints.
- Third-party licences — a paid carousel library, a premium theme you bought, an agency's own internal component kit, stock photography, a font licence.
- Design files and content — Figma, the copy deck, product photography.
Most disputes happen in categories 2, 3 and 5. Almost nobody fights about the theme.
Does the agency own my Shopify theme code?
In practice, no. If the theme is installed on your store, you can download it as a .zip from the admin in about four clicks, and nothing in Shopify's system asks the agency's permission. That is a practical reality that overrides most contract language, because possession of the files is what actually matters when a relationship ends badly.
Two caveats worth knowing.
First, if the build started from a paid theme from the Shopify Theme Store, the underlying theme is licensed, not owned. You can keep using it on the store it was bought for. You cannot resell it or run it on a second unrelated store. The customisations layered on top are a different matter and are typically yours.
Second, some agencies build on their own proprietary base — an internal starter theme they reuse across clients. The customisations are yours; the base may be licensed to you for use on that store only. That is a legitimate arrangement and it often makes the build faster and cheaper. It becomes a problem only when nobody told you, and you discover it when a new developer opens the code and finds a minified bundle with no source.
Ask before signing: is any part of this theme built on code you also license to other clients, and if so, what are my rights to modify it? A straight answer takes one sentence.
Who owns a custom Shopify app built by an agency?
Here is where the default flips. Under Indian copyright law, and under the law in most of the jurisdictions our clients operate in, the author of a work owns the copyright unless there is an agreement assigning it or a genuine employment relationship. An agency is a contractor, not your employee. So absent an assignment clause, the agency owns the source code of a custom app it wrote, and what you bought was a licence to use it.
Read that again if you have a custom app running your subscription logic or your B2B pricing tiers.
It gets more tangled when the app is hosted by the agency. You are then paying two things at once: a build fee and, implicitly, hosting. If the relationship ends, the app stops when the server stops. We have inherited stores where a critical integration was running on an agency's AWS account, with the database in their name, and the client had no credentials at all. Recreating it from scratch cost more than the original build.
Three arrangements, roughly ranked by how much control you get:
- Full assignment. You own the copyright outright, the repo transfers to your organisation, hosting sits in your cloud account. Costs more upfront because the agency cannot reuse the work. Right call for anything that touches revenue logic.
- Perpetual, irrevocable, transferable licence with source escrow. The agency keeps ownership and can reuse generic components, you get a permanent right to use and modify the code, and you get the source. This is the sensible middle and what we recommend most often.
- Licence only, agency-hosted, no source. Cheapest. Fine for something disposable. Not fine for anything you would be unable to trade without.
If you are commissioning something substantial, our page on Shopify app development sets out how we scope this, and ownership is part of the scope conversation, not an afterthought.
The IP ownership clause your contract should actually contain
Most templates say something like "all deliverables shall be the property of the Client upon full payment". That sounds complete. It is not, because "deliverables" is undefined and nobody agrees on whether it includes the repo, the CI pipeline, or the internal library the app imports.
A usable IP clause in a Shopify development contract names things. At minimum it should cover:
- Which artefacts transfer on final payment, listed by name — theme files, app source, repo, design files.
- What the agency retains: pre-existing tools, generic components, know-how. Do not fight this. An agency that cannot reuse its own utility functions will price accordingly.
- A perpetual, worldwide, transferable, sub-licensable right to use and modify anything retained, so a future developer is not blocked.
- A named list of third-party licences used, who holds them, and what transfers.
- A handover obligation with a deadline — say, all credentials and repo access within ten business days of termination, regardless of the reason for termination.
- Whether payment is a condition of transfer. It usually is, and that is fair. Just make sure it is tied to final invoice, not to a vague notion of "all outstanding amounts".
One more: if the agency carries professional indemnity or has signed an NDA, make sure code ownership and confidentiality are separate clauses. They get conflated and then neither works properly.
Collaborator account vs staff account, and why it matters more than you think
A collaborator account is how a Shopify Partner requests access to your store. You approve the request, you choose the permissions, and critically, a collaborator does not consume one of your plan's staff seats. It also cannot be used to remove the store owner. You can revoke it from Settings > Users, and the agency disappears in one click.
A staff account is an account on your store, occupying a seat, created by you. Some plans cap staff accounts, which is why agencies on Basic-plan stores sometimes ask for a staff login instead of collaborator access when the client has run out of seats.
Give collaborator access. Every time. Reasons:
- Revocation is instant and unilateral.
- Actions are attributed to the agency in the admin activity log, not to a generic "developer@yourbrand" login.
- It does not eat a seat, which on smaller plans matters.
- You can scope it down. A developer rarely needs access to customer PII or payout settings. Grant themes, apps, products; withhold finances unless there is a reason.
The worst arrangement, and we see it regularly: the agency created the Shopify store in the first place, using their own email as the store owner. Then the owner account is theirs, the billing card may be theirs, and the client is a staff user on their own business.
Can a Shopify developer lock you out of your store?
If they hold the store owner account, yes, effectively. The store owner is the only role that can transfer ownership, change the billing profile and delete the store. A staff user, even a full-permission one, cannot remove the owner.
If you hold the owner account, no. A collaborator or staff user cannot lock you out. They can do damage — delete a theme, uninstall apps, edit products — but you can revoke them and restore. Shopify keeps recent theme versions, and you can roll back from the theme library, though not indefinitely, so this is not a substitute for having the files.
So the single most important thing on this entire page: check who the store owner is right now. Settings > Users, top of the page. If the email is not one your company controls, fix it today. Transferring store ownership takes about two minutes and requires the current owner to initiate it, which is exactly why you want to do it while everyone is still friendly.
Shopify's support can help in genuine disputes where you can prove the business is yours — bank statements, GST registration, domain ownership, incorporation documents. It is a slow process and you will not enjoy it.
How to get theme files from your Shopify developer
Fastest route, no agency involvement needed: Online Store > Themes > the three-dot menu on the theme > Download theme file. Shopify emails a .zip to you. That gives you the published theme exactly as it runs.
What it does not give you:
- Source before build. If the agency used a build pipeline — Tailwind, TypeScript, a bundler — the .zip contains compiled output. Editing minified JS is possible and miserable. Ask for the source repo.
- Unpublished themes. Development and staging themes have to be downloaded separately. Do it.
- Metafield and metaobject definitions. These live in settings, not theme files. A new developer needs the schema documented or they will spend a day reverse-engineering it.
- Anything in app blocks. Content rendered by a third-party app is not in the theme.
If the developer is uncooperative, download what you can from the admin first, then revoke access, then negotiate. Doing it in the other order is how people lose things.
Transferring a private or custom app to a new agency
Shopify's app architecture changed, so the answer depends on what you actually have. Legacy private apps were replaced by custom apps created in your own Shopify admin under Settings > Apps and sales channels > Develop apps. If your app was created that way, the app config and its Admin API access token live in your store. You control them. Rotating the token and handing the new one to a different developer is straightforward.
If the app was created in the outgoing agency's Partner Dashboard — which is common for anything more complex, and necessary for anything using the Partner-only APIs — then the app belongs to their Partner organisation. It cannot simply be pointed at your account. There is a transfer process for apps between Partner organisations, but it needs the current owner to initiate it and it needs a receiving organisation.
A practical transfer sequence that works:
- Get the source code into a repo you own, before anything else.
- Document environment variables, webhook subscriptions, cron jobs and any queue workers. These are the things that silently stop.
- Stand up the app in infrastructure you control, or in the incoming agency's account with a written arrangement.
- Create a new app in your own admin or the new Partner organisation, install it on a dev store, verify behaviour.
- Cut over during a low-traffic window. Not during a sale. Not in October, if you sell in India.
- Leave the old app installed but inactive for a week, then uninstall.
Budget more time than feels reasonable. Webhooks that were registered manually two years ago are not in anyone's documentation, and you find them when an order fails to sync.
A Shopify agency offboarding checklist
Run this before the final invoice is paid, because leverage disappears the moment it clears.
- Confirm the store owner email is yours. Transfer if not.
- Download every theme — published, unpublished, staging.
- Get repo access transferred to an organisation your company owns, with full history. Not a .zip of the latest commit.
- List every custom app, note where it is hosted, who pays for that hosting, and when the card on file expires.
- Collect API credentials for anything the store talks to: Razorpay, your shipping aggregator, your ERP, your WMS, Google Merchant Center, Meta.
- Export metafield and metaobject definitions, or screenshot the definitions list at minimum.
- Check DNS. Who holds the domain registrar login? Who manages the records? Cloudflare accounts get forgotten constantly.
- Identify paid third-party libraries and confirm whose licence they are on.
- Get the Google Analytics, GTM and Search Console properties moved to your accounts with you as owner, not as a user the agency can remove.
- Ask for a written list of known issues and pending work. You will not get a complete one. Ask anyway.
- Revoke collaborator access last, after everything above is verified.
We get roughly a third of these wrong on the first pass when we inherit a store, not because the list is hard but because the outgoing agency has moved on and stopped replying. Which is why you do it before they move on.
What a fair arrangement looks like from the agency side
Being blunt about our own interests: an agency that gives away everything, including reusable internal tooling, has to charge more, and most clients would rather not pay for that. We keep our generic components. We do not keep your business logic, your theme, your data or your access.
There is also a version of this that goes too far the other way. A founder who demands full IP assignment on a ₹1.5 lakh landing-page build is negotiating over something worth less than the hour spent negotiating. Save the fight for the custom app that prices your products.
And if you are shopping around, ownership terms are a decent proxy for how an agency behaves generally. One that hesitates when you ask who holds the repo is telling you something. Our pricing and scoping approach is set out on the Shopify development cost page, and the ownership terms are in the contract, not buried in a schedule.
Do this today
Open Settings > Users in your Shopify admin and read the store owner email. Then open Themes and download the published theme. Ten minutes, and you have removed the two worst outcomes.
If you have inherited a store and cannot work out what is running on it or who controls what, we do a free audit that includes an access and ownership map alongside the technical findings. No obligation to hire anyone afterwards, including us.