Privacy Policy

Last updated: 5 August 2026

The short version. Consently asks your store for one read-only permission and never writes to it. It cannot see your products, orders or customers. It records no IP address, no user agent and no fingerprint for any shopper — the consent record holds a random id the shopper's own browser generated and nothing else about them. We do not sell data, and there is nothing here to sell.

Who this covers

Consently is a cookie-consent and privacy-request app for OpoShop stores, published by Found. This policy covers the Consently admin app, the consent notice it renders on a merchant's storefront, and the website at getconsently.com. If you are a shopper who saw a Consently notice on a store, the merchant running that store is the controller of your data; we process it on their behalf, and this describes exactly what that amounts to.

What we read from a merchant's store

When a merchant installs Consently, OpoShop grants it a single OAuth scope, users:read. We use it for two things:

Verifying who is asking. When the app loads inside the OpoShop admin we check, with the caller's own credential, that they really own the store they claim to. No session exists until that check passes.
Your store name and owner email, so the notice can be branded and privacy-request notifications can reach you.

That is the entire list. We do not read your products, your collections, your orders, your customers, your revenue or your inventory — an app whose purpose is helping you collect less data has no business collecting your customer list to do it. Consently never writes anything to your store.

The setup scan reads your published storefront home page, exactly as any visitor's browser would, to detect which tracking scripts are on it. That is a public page and the request carries no credential.

What we record about shoppers

This is the part that matters most for a consent tool, so we will be exact.

Daily counters per store. How many times the notice was shown, and how many people accepted everything, rejected everything, chose a mix, were opted out automatically by their browser's Global Privacy Control signal, or later changed their mind. These are plain integers bucketed by UTC day.
A consent receipt, if the merchant keeps them. One row per choice, holding: a random id the shopper's own browser generated, which categories they allowed, a coarse region (EU, UK, US or elsewhere), which version of the merchant's policy was on screen, how the choice was made, and the time. Receipts expire on the merchant's retention setting — around thirteen months by default — and deletion is enforced by the database itself, not by a job that has to run.
A privacy request, if a shopper files one. Only what they typed into the form: their email address, optionally a name and order number so the merchant can find them, and their message.

What is deliberately absent, everywhere: no IP address, no user agent, no device or browser fingerprint, no cookie id, no page URL, no advertising identifier. The receipt id is not derived from anything about the person; it exists so that the same browser can be shown its own record, and so a merchant can look one up if they are ever challenged. A consent tool that quietly built a profile in order to prove someone had refused profiling would have failed at the only job it has.

Region detection

When a merchant limits the notice to certain regions, Consently reads the time zone the browser already reports and nothing else. We deliberately do not perform an IP geolocation lookup: that would mean sending every shopper's address to a third party in order to decide whether to ask them about privacy.

Privacy requests

A request submitted through the storefront form is invisible and inert until the person who filed it clicks a one-time link we email to the address they gave. Without that step, "delete my data" would be a weapon anyone could point at anyone whose email they know. The link is single-use, expires in 48 hours, and its token is stored only as a hash — a copy of our database could not be used to verify anybody's request.

A submission that is never confirmed deletes itself within 72 hours. We do not keep a list of addresses that did not confirm.

Consently never acts on the merchant's store in response to a request. It does not delete a customer, export an order or change a record. It records the obligation and its statutory deadline; discharging it is the merchant's decision.

Cookies and browser storage the notice itself uses

consently_choice — a cookie and matching local-storage entry holding the categories the shopper allowed, the policy version, the time, and their coarse region. This is what stops them being asked again on every page.
consently_rid — the random receipt id, in local storage only.
consently_cfg_<store> — a cached copy of the store's public notice configuration, so the notice paints instantly instead of waiting on a network round trip.

None of these are used for advertising, profiling or analytics, and none of them travel to another site. The Consently admin uses browser storage to keep a merchant signed in.

Where data lives, and for how long

Store configuration, daily counters, consent receipts and privacy requests are held in Consently's own MongoDB database, scoped per store, hosted in the United States. Merchant configuration is kept for as long as the app is installed, and afterwards, so that reinstalling restores the exact notice rather than starting over. Receipts expire on the merchant's retention window. Closed privacy requests expire on the same window; open ones are kept until the merchant closes them, and can be deleted at any time.

Uninstalling

Removing Consently from a store immediately stops the notice rendering and stops all blocking — OpoShop calls our uninstall endpoint, and the public configuration endpoint starts answering "off" straight away, so even a cached copy in a shopper's browser goes inert. To have a store's stored data erased rather than retained, email brandon@tryfound.io and we will delete it.

Third parties

OpoShop — the platform the app is installed on, and the mail system that sends our three transactional emails.
Fly.io — hosting.
MongoDB Atlas — the database.
PostHog — product analytics for the merchant-facing admin only, never on a storefront and never about a shopper.

We do not sell data, we do not share it for advertising, and we run no advertising of our own.

Payments

Consently does not take payments and never sees a card number, a bank detail or a billing address.

Your rights

If you are in the EU, UK, California or another region with a privacy law, you have rights of access, correction, deletion and objection over data we hold. In almost every case the merchant whose store you visited is the right first contact, since they are the controller — but you can always write to us directly at brandon@tryfound.io and we will help.

Changes

If this policy changes materially we will update the date at the top and, where the change affects merchants, note it in the app's What's New page.

Contact

Found · brandon@tryfound.io