What we keep

Accounts use a username, a one-way password hash and, when generated, a one-way login-key hash. We never store your password or raw login key.

For orders we retain the items, totals, status, payment address, notes and a private random order token. Shipping addresses are encrypted with our PGP public key before they are written to the database; the plain-text address fields remain empty.

Cookies and logs

The shop uses a necessary session cookie for sign-in, the cart and form security. The server also records ordinary security and access logs, such as request time, path, browser details and network address.

Use and disclosure

We use this information to operate accounts, fulfil orders, prevent abuse and answer support requests. We do not sell personal information. Data is shared only when needed to provide the service, comply with law or protect the shop and its users.

For privacy questions, use the encrypted contact options on our contact page.