Doorst.app — Cookie Statement
Last updated: 29 July 2026
1. About this statement
This statement explains the cookies and similar technologies used on the Doorst.app website and application, operated by BTNG B.V. (KvK 91214777). It sits under our Privacy Policy.
2. What we use
Doorst uses two first-party cookies: one strictly necessary, one functional. Neither is used for analytics, marketing or tracking. Under the Dutch Telecommunicatiewet ("cookiewet") and the ePrivacy rules, strictly-necessary cookies and non-tracking functional cookies do not require prior consent, but we disclose them here.
The same rules cover similar technologies, such as local storage, and not only cookies. Section 2b sets out the one place we use local storage.
| Cookie | Purpose | Type | Duration | Details |
|---|---|---|---|---|
doorst_session | Keeps you signed in | Strictly necessary | 7 days (1 day during a god-view "view as" session) | First-party. HttpOnly, Secure, SameSite=Lax, Domain .doorst.app |
doorst-theme | Remembers light vs dark mode | Functional / preference | 1 year | First-party. Secure, SameSite=Lax, Domain .doorst.app (set by JavaScript, so not HttpOnly) |
2b. Local storage — the feedback widget (agency dashboard only)
The agency dashboard at app.doorst.app embeds UserJot, the tool where agencies send us feedback, vote on the roadmap and read the changelog. It is loaded from cdn.userjot.com and only for a signed-in agency user. It is not on the marketing site, not in the client portal, and not in the platform admin view, so an agency's own clients never encounter it.
It sets no cookies. It stores four keys in your browser's local storage on app.doorst.app, which we verified on 29 July 2026:
| Key | Purpose |
|---|---|
uj_userId | Which signed-in agency user the feedback belongs to |
uj_projectId | Which UserJot project the widget is pointed at |
uj_identifyHash | Avoids re-sending the same identification on every page load |
uj_lastSeenUpdate | Remembers which changelog entry you last saw |
To attribute your feedback we pass UserJot your user id, email address, name and avatar from your Doorst account. UserJot is a US company; that processing is described in our Privacy Policy. It is not a sub-processor under our DPA, because it never touches the data an agency holds about its own clients.
This storage is functional and not used for advertising or cross-site tracking. If you would rather it were not there, clear local storage for app.doorst.app in your browser; the dashboard keeps working, and you simply lose the "what's new since you last looked" marker.
Analytics (Plausible): no cookies. Plausible is cookieless by design, which is why we chose it.
Payment and invoicing (Mollie, Moneybird): any cookies these set during a payment or OAuth redirect live on their own domains, not on doorst.app. They are not first-party Doorst cookies, so they are covered as processors in our Privacy Policy rather than listed here.
Security (Cloudflare): our site runs behind Cloudflare. If Cloudflare's bot protection is active, it may set an essential security cookie (for example __cf_bm, roughly 30 minutes). These are strictly necessary for security and require no consent. We verified on 23 June 2026 that no __cf* cookies are set under our current configuration; if bot protection is later enabled, __cf_bm may appear and we will list it here.
3. Analytics — no cookies
We use Plausible Analytics to understand, in aggregate, how the site and app are used. Plausible is cookieless: it sets no cookies, does not track you across websites, and does not collect data that identifies you personally. Because it is cookieless and anonymous, Doorst does not show a cookie-consent banner and you do not need to make a cookie choice to use the site.
4. If this changes
If we ever introduce technologies that read from or write to your device for non-essential purposes — cookies or similar storage alike, for example Google Analytics, advertising pixels, or third-party embeds that track you — we will first ask for your prior, granular opt-in consent through a consent banner where refusing is as easy as accepting, with no pre-ticked boxes, and we will update this statement.
The feedback widget in Section 2b is the one third-party embed we run. It stores nothing about you until you are signed in as an agency user, it does not track you across sites, and it is confined to the dashboard you are logged into. We list it here rather than behind a banner for that reason.
5. Managing cookies
You can delete or block cookies through your browser settings. Note that blocking strictly-necessary cookies will stop you being able to log in or use the app.
6. Contact
Questions: BTNG B.V. — privacy@doorst.app — Willem Roelofsstraat 3, 7424 GD Deventer, The Netherlands — KvK 91214777.