Doorstep is a personal, non-commercial tool for seeing your own deliveries in one place. It is not offered as a service to the public.
What this page does
This page is a static file. It has no server, no accounts, no analytics and no ads, and it stores no package data of its own. It only draws the list it receives from a private Google Apps Script that you run in your own Google account.
Where your data lives
Shipping emails stay in your Gmail. The script reads the inbox it is installed in, read-only, and writes one row per package to a Google Sheet in the same account. Nobody else can open that sheet unless you share it.
What is kept on your device
Your browser stores the private link to your script and the last package list it loaded, so the page opens quickly and works offline. "Disconnect this device" on the main page erases both.
Third parties
The page is served by GitHub Pages, and it talks to Google (your script, plus Google's public icon service for store logos). Product photos, when shown, load from the store that sent the email. Each of those can see that a request was made, as with any website.
The private link
Anyone who has your private link can see your package list. Share it only with people you want to see it. You can replace the key at any time by running rotateKey in the script.