Privacy

What we collect

• Email address. You give it at checkout so we can show you your order and, if you ask, reach you about an order. It is the only thing we need to sell to you; an account is optional.
• Order details. What you bought, what you paid, the payment reference from the payment processor, and the logs delivered to you. We keep these so you can come back to your order and so we can handle replacements, refunds and disputes.
• Account details (only if you create an account): your email, a hashed password (we never store the password itself), your recovery key as a hash, your store balance and its history.
• Technical details. The IP address and browser of each order, sign-in and support message, and the country that address maps to. We use them to spot fraud, abusive behaviour and account takeovers, to decide on refunds and replacements, and to block automated attacks. The country lookup happens on our own server; your address is not sent to anyone for it.
• Support messages you send from an order page, together with the order they belong to.

What we do not do

• We do not sell or rent your data, and we do not use it for advertising.
• We do not run third-party analytics or advertising scripts.
• We do not store card numbers or wallet keys. Payments are made in cryptocurrency through our payment processor; what they collect is covered by their own privacy policy.

Cookies and storage

• A session cookie keeps you signed in to your account, and a short-lived cookie protects the checkout forms against bots.
• Your basket is kept in your own browser's storage until you check out or clear it.
• No tracking cookies.

How long we keep it

• Orders and their logs are kept for as long as the store runs, so your order page keeps working and we can resolve problems with a purchase.
• Sign-in history is capped at the most recent entries per account. Addresses blocked for abuse are forgotten after 24 hours.
• Support messages stay attached to the order.
• If you delete your account (or ask us to), the account, its sessions and its balance history are removed; orders are kept as guest orders so their order links keep working.

Security

The site is served over HTTPS only, passwords are hashed with a slow algorithm, and the admin area is protected by additional authentication. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you.

Your rights

You can ask us what we hold about you, ask for it to be corrected or deleted, and object to how we use it. Contact us through the support box on your order page. We answer as soon as we can.

Changes

We may update this notice when the store changes. The date at the top of this page shows when it was last changed.

This notice is provided by Slimz.