Privacy policy

Order data. Your name, delivery address, email address and, if you give it, a telephone number. We need these to take payment, clear customs and deliver the parcel.

Account data. If you create an account, your email address, your name and a hashed password. We never store the password itself.

Order history. What you bought, when, and the amounts charged.

Technical data. A cart identifier held in a cookie so that your basket survives a page reload, and a separate reader identifier if you like, save or comment on a journal entry. Standard server logs recording requests, which we use to keep the service running and to investigate faults.

Comments. If you comment on a journal entry, the text of the comment is stored and published on that entry under a short reader handle (for example “Reader 3F2A”) derived from your reader identifier. We ask for no name and no email address. The identifier is stored with the comment so repeat comments can be recognised.

Visit counts. We count page views ourselves, on our own server. Each view is reduced to the page address, the domain name of the site that referred you (if any), a country taken from our network provider, and a device class — phone, tablet or desktop. Your IP address and browser user agent are used only to compute a visitor identifier: a salted one-way hash that is different for every visitor and changes at the start of each month. Neither the address nor the user agent is stored, and the hash cannot be reversed into either.

Card details are entered on the payment processor’s own hosted page and are never transmitted to or stored on our servers. We receive only a reference to the resulting transaction, its status, and the last few digits if the processor provides them.

To perform the contract you entered into when you ordered; to meet our legal obligations, including tax, accounting and customs records; and for our legitimate interest in keeping the store secure and free of fraud.

We do not sell personal data, and we do not use it for advertising profiling.

Payment provider. To process your card.

Carriers and customs brokers. Your name, address and a description of the goods, because a cross-border parcel cannot move without them. Customs authorities of the destination country see the same information.

Hosting and email providers. Who process data on our instructions.

We set a strictly necessary cookie to identify your cart. It carries a random identifier and nothing else, and it is what allows the basket to persist between pages.

If you like, save or comment on a journal entry, we set a second strictly necessary cookie holding a random reader identifier. It is not linked to your cart, your account or the visit counts, and it is used only to remember which entries this browser has reacted to and to slow down repeated comments. It expires after one year.

We do not set advertising or cross-site tracking cookies, and we do not build a profile of you across other sites. The visit counts described above use no cookie and store nothing on your device, so there is no cookie banner to dismiss. If your browser sends Do Not Track or Global Privacy Control, the counter does not run at all.

Order and invoice records are kept for as long as tax and customs law requires. Account data is kept until you ask us to delete the account. Journal comments remain until you ask us to remove them. The reader cookie expires after one year. Server logs are kept for a short operational period and then discarded.

You may ask for a copy of your personal data, ask us to correct it, ask us to delete it, or object to a particular use. Where we rely on consent you may withdraw it at any time. You may also complain to your national data protection authority.

California residents have the right to know what is collected, to request deletion, and not to be discriminated against for exercising those rights. We do not sell personal information.

Write to [email protected] to exercise any of these. We may need to verify your identity before acting.

Data may be processed outside your country, including in transit countries and at our suppliers. Where data leaves the EEA we rely on appropriate safeguards for the transfer.