Cove Wishlist

Moving from Swym Wishlist Plus to Cove Wishlist

Published 2026-10-20. Facts about Swym checked 2026-10-20.

This guide gets your customers’ saved items out of Swym Wishlist Plus and into Cove Wishlist, and covers the clean-up on your theme. We publish Cove Wishlist, so we are not a neutral party; every claim about Swym below links to where we read it, and what we could not confirm is marked Not confirmed.

1. Where things stand
2. Before you start
3. Export from Swym
4. Import into Cove
5. What can’t be moved
6. Remove Swym’s app embeds and blocks
7. Check your theme files
8. How Cove is built differently
9. Sources and what we couldn’t confirm

Where things stand

As of 2026-10-20, Swym’s own FAQ says it detected unauthorized activity over the past week, in which someone tried to add malicious code to merchants’ storefronts through the Wishlist Plus app so that shoppers were redirected away from the store. Swym then paused the app for all merchants and revoked its own Shopify access, which is why the app does not open in Shopify admin. Swym says pausing does not delete wishlist data and that it will give a restore timeline later. This page does not repeat the full story; our write-up has it, with sources.

Before you start

• You don’t have to wait for Swym. You can install Cove Wishlist now and import later: uploading the same file twice never creates duplicate items.
• Don’t uninstall Swym until you hold your export. Swym says that leaving the app installed is safe while its access is revoked. We could not find what Swym does with a store’s data when the app is uninstalled, so treat that as Not confirmed and ask support@getswym.com before you remove it.
• Customers are matched by email. Cove only imports lists for shoppers who have a customer record in your Shopify store with the same email address.

Export from Swym

Swym’s admin is not reachable right now, and Swym’s FAQ says nothing about exporting during the pause. If you can’t open the app, the options are: wait for access to return, or write to support@getswym.com and ask whether they can send you the data. Not confirmed: whether Swym support will produce an export on request. The steps below describe Swym’s admin from its own help pages, for when access is back or if you already have a file.

Best option: the Shoppers report

This is the file Cove’s importer is built around. Swym’s help centre describes it two ways, and we could not check which matches a live account today:

• Older layout (August 2025): in Shopify admin go to Apps > Wishlist Plus > Insights > Metrics, click detailed report under Shoppers, pick a date range, click Apply, then export. The CSV downloads automatically.
• Newer layout (March 2026): Apps > Wishlist Plus > Reports. Choose the Wishlist Activity Report, set a date range and click Export. The date range is limited to 60 days at a time, so for a longer history Swym says to export in 60-day chunks. Upload each chunk to Cove in turn; items that are already saved are skipped.

The older article lists these columns for the Shoppers report: UserEmail, ProductId, VariantID, SKU, PageURL, ListName and CreatedDate (plus product title and variant columns). Cove’s importer recognises that header row. For the newer Wishlist Activity Report, Swym’s article names the data (email, product title and SKU, list name, created date) but not the exact CSV headers: Not confirmed that it uploads without changes. If Cove says it doesn’t recognise the columns, it will tell you what it needs, and a CSV with an email column plus a product ID, variant ID, SKU or product URL column works too.

Other routes Swym documents

• Segment download (paid plans only; marketing segments such as Wishlist Winback). It covers the past 180 days and is delivered after you confirm an email address. Swym’s guide doesn’t list the columns, so we can’t say whether Cove can read it: Not confirmed. Prefer the Shoppers report.
• REST API, on Swym’s Premium plan and above, with a key requested from Swym support (Swym’s article). Because Swym says it rotated all credentials, whether keys can be issued during the pause is Not confirmed. Cove has no API importer; you would turn the result into a CSV first.
• Your email tool. If you synced Swym to Klaviyo, Omnisend or a similar tool, that tool may hold email and product pairs. That is our suggestion, not something Swym documents.

Import into Cove

In Shopify admin open Cove Wishlist, then Import. Nothing is saved to anyone’s wishlist until you press the final button.

1. Upload

Drop the CSV on the upload box (.csv or .txt, up to 50 MB) and press Check file. Cove reads the header row to work out whether it is a Swym Shoppers report, a Swym import file or a generic CSV.

2. Preview (a dry run)

Cove matches each email to a Shopify customer and each row to a product (by product ID, then variant ID, then SKU, then the handle in the product URL). The preview shows how many customers matched out of those in the file, how many products matched, how many items will be imported and how many are already in a wishlist. You can leave the page while a large file is checked.

3. Confirm

Press Import N items to go ahead or Cancel to stop. Importing the same file again adds nothing new. On Pro, Swym’s list names are kept as named lists; on other plans every item goes into the customer’s one wishlist.

4. The skip report

Rows Cove can’t import are counted by reason in the “Skipped because” table. Download skipped rows gives you a CSV with the line number in your file, the reason and the product reference (ID, variant ID, SKU, handle) for each skipped row, with no email addresses in it. The reasons are:

• No email (a guest or blank row).
• No customer with that email in your store.
• No product ID, variant ID, SKU or product URL.
• Product no longer in your store.
• The same item listed twice in the file.
• Already in the customer’s wishlist.
• The list already has 500 items.

What happens to the file

Emails are used in memory to find each customer and are never written to our database, logs or the skip report. The uploaded file is kept encrypted until the import ends and deleted after 24 hours at the latest. If Shopify has not yet approved the app to read customer emails on your store, Cove says so and customers can’t be matched until it does. See the privacy policy.

What can’t be moved

Lists saved by shoppers who were never signed in. Swym’s own help says a guest’s wishlist has no email address attached and lives in one browser on one device (Swym’s article). A file keyed by email can’t carry it, and Cove matches by email, so those rows are skipped as “No email”. Those lists exist only in each shopper’s browser; there is no way for either app to move them from there. Not confirmed: whether Swym’s exports include guest rows at all, because Swym doesn’t say.

Also not carried over: Swym’s settings, alert history, marketing segments and analytics, and the look of Swym’s buttons. Set up the look in Cove’s Design Studio.

Remove Swym’s app embeds and blocks

Once Cove is live (or sooner, if the dead Swym buttons annoy your shoppers). Swym’s FAQ says the Swym icons and buttons may still show but don’t work while the app is paused. Its steps, from the FAQ:

1. In Shopify admin open Online Store > Themes and click Customize on your live theme.
2. Open App embeds.
3. Turn off the two Swym embeds, App Control Center and Storefront UI Elements, and click Save.

Blocks. Swym’s wishlist buttons can also be added as app blocks on product, collection and cart pages. Open each of those templates in the theme editor, find any block that belongs to Swym Wishlist Plus, and remove it (select it, then Remove block). Block names depend on your theme and we haven’t verified Swym’s block names, so go by the app name shown on the block. Repeat for every theme you might publish again, not just the live one.

Code you or a developer pasted in. If a developer ever added Swym snippets to your theme files by hand, search the code for swym and remove those too. Only do this on a duplicate theme first, and test.

Then switch on Cove’s app embed and add its blocks from the same theme editor.

Check your theme files

Swym’s FAQ names a malicious domain, checkout-guard[.]top, and asks merchants who haven’t been contacted to look in their theme code. The “[.]” is Swym’s way of keeping the address from being clickable; in a search, use just checkout-guard. Swym’s steps:

1. Open Online Store > Themes and click Edit code on your live theme.
2. Look for any theme file edits that show as made by the Swym app.
3. Search all theme files for checkout-guard. Swym also lists three domains it has seen in similar attacks: account-confirm[.]top, billing-confirm[.]top and checkout-secure[.]top.

If you find edits by the Swym app that you don’t recognise, or any of those domains, Swym says to check with your developer, test the store, and revert the files to the version from before the change; it notes that Shopify keeps older versions of each theme file. If shoppers tell you they were sent to another site, report it to support@getswym.com with the page and time.

How Cove is built differently

We can’t promise Cove will never have an incident; it is a new app with no track record yet. What we can point at is how it is built so that the two routes above are closed. You can check each against what Shopify shows when you install it.

• No theme write access. Cove never asks for write_themes, write_script_tags or write_online_store_pages, so it can’t edit your theme files.
• The only write scope is write_app_proxy. It lets Shopify route your store’s /apps/wishlist address to the app and can’t change products, customers, orders or code. The other scopes are read-only. An automated test fails the build if the scope list changes.
• No remote code. The JavaScript that runs on your storefront ships only inside the app’s theme extension, which Shopify versions on every deploy. Our servers return JSON, never scripts or HTML, and the code never uses eval or innerHTML (the linter enforces that).
• Design is rendered by Liquid from a metafield the app owns. The storefront script never fetches design or settings from our servers, so a setting is data that Shopify renders, not code that runs in the browser.
• Minimal customer data. Shopify IDs, plus a guest’s email for a back-in-stock alert they asked for (encrypted, deleted once sent); emails from an import are used in memory and dropped.

More on the security page, including what we commit to doing if we ever have an incident.

Sources and what we couldn’t confirm

1. Wishlist Plus Security Precaution: Frequently Asked Questions (Swym)
2. Swym service status (Swym)
3. Shopify shops hit with ongoing Checkout Hijack attack (Roman Zipp (independent researcher))
4. Comprehensive guide to Wishlist Plus customer accounts, reports and analytics (Swym help centre, March 2026)
5. How to export wishlist activity reports (Swym help centre, August 2025)
6. Shopper segment data download guide (Swym help centre, August 2025)
7. API key management: request, use and best practices (Swym help centre, August 2026)
8. Login nudge: prompt guest shoppers to sign in and save their wishlist (Swym help centre, August 2026)

Swym’s help pages describe two different admin layouts and we couldn’t sign in to Swym to check either. Everything marked Not confirmed above is something Swym hasn’t published or we couldn’t verify. If something here is wrong or out of date, tell us at contact@stackcraftdigital.co.uk and we’ll correct it.