1. What we collect
We collect the minimum account, order, payment-status, delivery, support, and security information needed to operate the shop.
2. PGP protection
Delivery addresses, checkout notes, and customer-written support messages are automatically encrypted with the store public PGP certificate before database storage. If encryption is unavailable, the sensitive submission is rejected instead of being stored as plaintext. Email addresses, destination country, order totals, operational status, and fraud-prevention metadata remain available where required to fulfil and secure the order.
3. Secret links
Secret-link content uses a separate recipient-oriented encryption flow and expiration controls so its intended recipient can open it.
4. Session
Messaging connections are optional. A linked Session account stores its Session ID, verification state, and notification choices. Verification codes expire. Messaging networks process delivery metadata under their own policies.
5. Retention and access
Access is limited to authorized staff and operational services. Records are retained only as long as reasonably required for fulfilment, support, security, accounting, and applicable obligations.
6. Cookies and security
Essential session cookies, private order links, rate limits, and pseudonymous security records keep accounts and checkout working and help detect abuse.
7. Your choices
You may omit an email during guest checkout, submit an already-encrypted PGP delivery block, and choose which Session notifications to receive. Contact support for applicable access, correction, or deletion requests.
8. Contact
Use the support page for privacy questions and avoid sending unnecessary sensitive information.
