Privacy policy
Last updated: 31 October 2026
Who we are
ClearGate is an age gate app for Shopify stores, provided by Southwood Marketing. You can reach us at support@southwood.dev.
This policy covers two groups of people: merchants who install ClearGate, and the visitors to their stores who see the age gate.
What we do not collect
No personal data about your store's customers or visitors reaches our servers. The age gate runs in the visitor's own browser. It does not send the visitor's answer, age, IP address or anything else to us. ClearGate does not ask Shopify for any customer data.
What we store about merchants
We store the following in a database hosted on Cloudflare (Cloudflare Workers and Cloudflare D1).
| What | Details |
|---|---|
| Shopify sessions | One record per store, so the app can talk to the Shopify Admin API for that store. Fields: a session ID, the shop domain, an OAuth state value, the granted access scopes, the access token and its expiry, and a refresh token and its expiry. The app uses offline access tokens only, not online (per-staff-member) tokens. The session record also has columns for a staff member's name, email address, user ID and locale. Because we do not use online tokens, ClearGate never fills them in. |
| Shop domain and install time | The store's .myshopify.com domain and the time ClearGate was last installed or its access token last refreshed. We use the time to ignore late, repeated webhook messages from an earlier install. |
| Backup of your age-gate rules | A copy of the rules you save in the app (pages, minimum ages, answer handling and gate text). Shopify deletes the live copy of your settings when the app is uninstalled, so this copy lets a reinstall restore them. |
| Plan status | The shop domain, whether a ClearGate plan is active, the plan handle, the trial end date and the time we last checked. |
ClearGate asks Shopify for read access to your products (to list collections and product types for your rules), your languages and your themes (to check whether the app embed is switched on). It reads nothing about orders or customers.
Billing
Shopify bills for ClearGate plans. We never see payment details. We ask Shopify whether your store has an active ClearGate plan, and store only the plan status listed above.
Server logs
Our hosting provider, Cloudflare, records basic request logs when the ClearGate admin or Shopify (for example, a webhook) contacts our servers: the time, the address requested, the response and the requesting IP address. They may include your shop domain. We use them only to find and fix errors, and Cloudflare deletes them after a few days. Storefront visitors never contact our servers, so they never appear in these logs.
Who processes data for us
- Cloudflare hosts the app and its database.
- Shopify runs your store and the age gate on it, and handles app billing.
We don't sell or share merchant data with anyone else.
What the age gate stores in the visitor's browser
The gate sets one cookie, cleargate_age. We treat it as strictly necessary: without it the gate would ask the same visitor on every page.
- What it holds: the answer and the day it was given. A Yes is stored as
yfollowed by the age that was shown, a dot and the day number (days since 1 January 1970), for exampley18.20000. A No, stored only if the merchant has turned on “Remember a No answer”, is stored asn, a dot and the day number. It holds no name, email address or other identifier. - How long it lasts: as long as the merchant chose under “Remember a Yes answer for”: this browsing session only, 7, 30 or 90 days. Each visit renews it, but never beyond that number of days from the day the visitor answered. Safari limits cookies set by page scripts to 7 days, so Safari visitors may be asked again sooner.
- Settings: path
/, SameSite=Lax, Secure, set by the gate's script on the store's own domain. It is never sent to ClearGate. - Nothing else: the gate uses no localStorage, sessionStorage or other cookies. In the Shopify theme editor it neither reads nor writes the cookie.
When a merchant has set different minimum ages for different countries, the gate makes one optional request from the visitor's browser to the store's own Shopify address, /browsing_context_suggestions.json, to learn the visitor's country. That request goes to Shopify on the store's domain. ClearGate's servers never receive it. Shopify handles it under its own policies.
Shopify's mandatory privacy webhooks
customers/data_requestandcustomers/redact: we hold no customer data, so there is nothing to return or delete. We acknowledge the request and keep no copy of its contents.shop/redact: Shopify sends this 48 hours after a store uninstalls ClearGate. We then delete everything we hold for that shop: sessions, shop domain and install time, the rules backup and the plan status.- On uninstall itself, we delete the sessions and the plan status. We keep the rules backup and the install time until
shop/redactarrives, so that a quick reinstall restores your rules.
Your rights and requests
Merchants can ask us what we hold about their store, or ask us to correct or delete it, by writing to support@southwood.dev. Uninstalling the app starts the deletion described above. Visitors with questions about the age gate on a store should contact that store, which decides how it is used.
Changes to this policy
If we change this policy we will update the date. Last updated: 31 October 2026.