ForewarnPrivacy Policy
The short version. Forewarn reads your store's orders and customers so it can score them for risk, stores that scoring in a database scoped to your store alone, and tells you what it found. It cannot write to your store. It does not sell, share or rent anything to anybody. You can erase everything it holds at any time, from inside the app.
Who this covers
This policy covers the Forewarn application installed on an OpoShop store, its admin interface at
app.tryforewarn.com, and the marketing site at tryforewarn.com.
What Forewarn reads from your store
When you install Forewarn, you grant it read access via OpoShop's OAuth. It reads:
- Orders — order number, date, total, line items, and the shipping address.
- Customer records attached to those orders — name, email address, phone number if present, the addresses your store already holds for that customer, how many orders they have placed, and when the record was created.
- Your store identity — store name, subdomain, and the owner email, so notifications and digests reach the right person.
It reads nothing else. It has no access to payment card details — those never reach Forewarn and are not exposed by OpoShop's API to any app.
What Forewarn stores, and for how long
For each order it scores, Forewarn keeps a record containing the facts above plus the score, the rules that fired, and the evidence behind them. It also keeps your rule configuration and notification preferences.
This is kept for as long as the app is installed, because the history is what makes the velocity and repeat-address rules work at all. Uninstalling pauses the app and retains your data so a reinstall picks up where you left off; if you want it gone immediately, use Settings → Erase data inside the app, which deletes every scored order for your store on the spot. You can also email us and we will do it for you.
Where it is stored, and who can reach it
Data is stored in a MongoDB database operated by Found, in a collection scoped by your store's identifier. Every query the application makes is filtered by that identifier, so one store's watchlist is never visible to another. Access is limited to the operator of the service for support and maintenance.
What Forewarn writes back to your store
Exactly two things, and neither touches money or an order:
- A message in your own OpoShop notification tray when an order is flagged.
- Its own webhook subscription, so it hears about new orders.
Forewarn does not request, and therefore cannot exercise, permission to charge, refund, capture, void, cancel, edit, fulfil or delete anything in your store.
Alerts and digests are sent to the store owner (or an address you choose in Settings) through OpoShop's own mail system. Forewarn never emails your shoppers, and shopper email addresses are never used for marketing of any kind — by us or anyone else.
Third parties
- OpoShop — the platform your store runs on; the source of the data and the transport for notifications and email.
- MongoDB Atlas — database hosting.
- Fly.io — application hosting.
- PostHog — product analytics. Events are keyed to a store identifier, never to a shopper. No customer names, emails or addresses are ever sent to it.
No data is sold, rented, or shared for advertising. There is no data broker in this list and there never will be.
Risk scoring is not a decision about a person
A Forewarn score is a prompt for a human to look, not an automated judgement. Forewarn does not block, cancel or refuse anybody — it has no power to. Any action taken on an order is taken by the merchant, in their own admin, for their own reasons.
Your rights
If you are a merchant, you can export, correct or erase what Forewarn holds about your store at any time via the app or by emailing us. If you are a shopper and believe a store using Forewarn holds data about you, contact that store directly — they are the controller of their customer data; Forewarn processes it on their behalf.
Changes
If this policy changes materially, the date at the top changes and the app's release notes will say so.
Contact
brandon@tryfound.io — we answer.