Privacy Policy

Last updated: 12 October 2026

The short version. Doorly is read-only against your store. It never writes anything. It collects nothing that identifies a shopper: no name, no email, no IP address, no cookie identifier, and no date of birth. When a shopper enters a date of birth on the age gate, it is compared in their own browser and discarded before anything is sent anywhere. We do not sell data, and we never will.

Who we are

Doorly is an age-verification app for OpoShop stores, published by Found. This policy covers the Doorly app, the storefront age gate it renders, and the website at trydoorly.com. Contact: brandon@tryfound.io.

Merchant store data

When you install Doorly, OpoShop's OAuth flow grants us a store access token. We request the narrowest scopes the app can function with (users:read, products:read, collections:read) and no write scope of any kind. With them we read:

Your store's identity (store name, subdomain, owner email) to confirm you own the store you are configuring, and to label the app.
Your collections and products (name, slug, id) so you can choose which of them the age gate applies to.

That is the complete list. Doorly does not read your orders, your customers, your revenue, or your inventory, because an age gate has no business knowing any of it.

Shopper data

This is the part that matters most for an age gate, so we will be exact.

Dates of birth are never transmitted. In date-of-birth mode, the date a shopper types is compared against your minimum age in their own browser and then discarded. It is not sent to Doorly, not stored, and not written to any log.
The confirmation is stored on the shopper's own device, as a cookie and a matching browser storage entry, so they are not asked again during the window you set. It holds only a timestamp and the age they confirmed. It is not an identifier, it is not shared, and it is never sent to us.
We record counts per store, per day: how many times the gate was shown, how many shoppers confirmed, and how many were turned away, plus how many times the gate was shown on each of your product and collection pages (by the page's public address). These are plain numbers. They carry no IP address, no cookie id, no device fingerprint, no user agent, and nothing that could be linked back to a person.
We note when your storefront last loaded the gate. One timestamp per store, so the app can tell you whether the gate is actually running. It says nothing about who the visitor was.

There is no shopper profile in Doorly, because there is nothing to build one from.

Payment data

Doorly never sees, handles, or stores card or payment data. It is not part of your checkout and has no access to it.

Where data is stored, and for how long

Your configuration and the daily counts are stored in Doorly's own MongoDB database, kept separate per store so that one store cannot read another store's data. The app is hosted on Fly.io in the United States.

We keep your configuration for as long as the app is installed, plus a short period afterwards so that reinstalling restores your exact gate rather than starting you over. Daily counts are kept so you can look back at them. Request deletion at any time by emailing us and we will remove your store's data.

Uninstalling

When you remove Doorly, OpoShop stops loading it on your storefront, so the age gate stops showing. Once OpoShop confirms the removal to us, Doorly also switches your gate off on its side. The access token OpoShop gave us stops working.

Sub-processors

Fly.io: application hosting.
MongoDB Atlas: database.
PostHog: product analytics for the merchant-facing admin only (which settings get used). No shopper data is ever sent to it, and no personally identifying merchant data.

Cookies

On your storefront, Doorly sets first-party cookies whose names start with dly_. They hold the age a shopper confirmed and when, so a shopper who has already confirmed is not asked again. If you gate single products, there is one per product the shopper has confirmed for. Doorly also keeps a copy of your gate settings in the shopper's browser storage so the gate appears quickly on the next page. It is not a tracking cookie and it is not used for advertising, profiling, or analytics. The Doorly admin uses browser storage to keep your session.

Your rights

Depending on where you are, you may have rights to access, correct, export, or delete data we hold about you as a merchant. Email brandon@tryfound.io and we will action it. For shoppers, there is generally nothing to action, because we hold nothing that identifies them.

Changes

If this policy changes materially we will update the date at the top and, where the change affects how data is handled, notify merchants in the app.

Contact

brandon@tryfound.io