diff --git a/.env.example b/.env.example
index d9f1f0f..916b740 100644
--- a/.env.example
+++ b/.env.example
@@ -2,7 +2,7 @@
 # Never commit the real .env — this file is the template only.
 SHOPIFY_API_KEY=
 SHOPIFY_API_SECRET=
-SCOPES=read_products,read_customers,read_orders,write_orders,read_locations,read_metaobjects,write_metaobjects,write_cart_transforms,write_delivery_customizations,write_payment_customizations,read_markets,read_locales
+SCOPES=read_products,read_orders,write_orders,read_locations,read_metaobjects,write_metaobjects,write_cart_transforms,write_delivery_customizations,write_payment_customizations,read_markets,read_locales
 SHOPIFY_APP_URL=https://replace-with-your-tunnel-url.example.com
 SHOP_CUSTOM_DOMAIN=
 
diff --git a/shopify.app.toml b/shopify.app.toml
index 74ce3ce..737ac9e 100644
--- a/shopify.app.toml
+++ b/shopify.app.toml
@@ -7,7 +7,14 @@ embedded = true
 
 [access_scopes]
 # Learn more at https://shopify.dev/docs/apps/tools/cli/configuration#access_scopes
-scopes = "read_customers,read_locales,read_locations,read_markets,read_metaobjects,read_orders,read_products,write_cart_transforms,write_delivery_customizations,write_metaobjects,write_orders,write_payment_customizations"
+# read_customers deliberately omitted: no feature currently calls the
+# Customers API (Booking.customerEmail/customerPhone come straight off the
+# orders/create webhook payload, covered by read_orders) — requesting it
+# unused would also gate this app behind Shopify's Protected Customer Data
+# Access approval for no reason. Add it back only when a feature (e.g. the
+# "recognize returning customers" parity item) actually needs it, and
+# expect to need that approval granted at that point.
+scopes = "read_locales,read_locations,read_markets,read_metaobjects,read_orders,read_products,write_cart_transforms,write_delivery_customizations,write_metaobjects,write_orders,write_payment_customizations"
 
 [auth]
 redirect_urls = [ "https://shopify.dev/apps/default-app-home/api/auth" ]