Privacy Policy
Last updated: 4 August 2026
Who we are
Doorly is an age-verification app for OpoShop stores, published by Found. This policy covers the Doorly app, the storefront age gate it renders, and the website at trydoorly.com. Contact: brandon@tryfound.io.
Merchant store data
When you install Doorly, OpoShop's OAuth flow grants us a store access token. We request the narrowest scopes the app can function with — users:read, products:read, collections:read — and no write scope of any kind. With them we read:
- Your store's identity (store name, subdomain, owner email) to confirm you own the store you are configuring, and to label the app.
- Your collections and products (name, slug, id) so you can choose which of them the age gate applies to.
That is the complete list. Doorly does not read your orders, your customers, your revenue, or your inventory, because an age gate has no business knowing any of it.
Shopper data
This is the part that matters most for an age gate, so we will be exact.
- Dates of birth are never transmitted. In date-of-birth mode, the date a shopper types is compared against your minimum age in their own browser and then discarded. It is not sent to Doorly, not stored, and not written to any log.
- The confirmation is stored on the shopper's own device, as a cookie and a matching localStorage entry, so they are not asked again during the window you set. It holds only a timestamp and the age they confirmed. It is not an identifier, it is not shared, and it is not readable by us.
- We record three counters per store, per day: how many times the gate was shown, how many shoppers confirmed, and how many were turned away. These are plain integers. They carry no IP address, no cookie id, no device fingerprint, no user agent, and nothing that could be linked back to a person.
There is no shopper profile in Doorly, because there is nothing to build one from.
Payment data
Doorly never sees, handles, or stores card or payment data. It is not part of your checkout and has no access to it.
Where data is stored, and for how long
Your configuration and the daily counters are stored in Doorly's own MongoDB database, scoped strictly per store — one store can never read another store's data, and this is enforced at the database index level as well as in the application. Data is hosted on Fly.io in the United States.
We keep your configuration for as long as the app is installed, plus a short period afterwards so that reinstalling restores your exact gate rather than starting you over. Daily counters are retained as your verification record. Request deletion at any time by emailing us and we will remove your store's data.
Uninstalling
Removing Doorly from your store immediately stops the age gate rendering — OpoShop calls our uninstall endpoint, and the storefront configuration flips off at once. Your access token is no longer usable.
Sub-processors
- Fly.io — application hosting.
- MongoDB Atlas — database.
- PostHog — product analytics for the merchant-facing admin only (which settings get used). No shopper data is ever sent to it, and no personally identifying merchant data.
Cookies
On your storefront, Doorly sets exactly one first-party cookie
(doorly_ok_<age>) holding a timestamp, so a shopper who has already
confirmed is not asked again. It is not a tracking cookie and it is not used for
advertising, profiling, or analytics. The Doorly admin uses browser storage to keep your
session.
Your rights
Depending on where you are, you may have rights to access, correct, export, or delete data we hold about you as a merchant. Email brandon@tryfound.io and we will action it. For shoppers, there is generally nothing to action — we hold nothing that identifies them.
Changes
If this policy changes materially we will update the date at the top and, where the change affects how data is handled, notify merchants in the app.