Draft text, pending legal review.

Privacy

What we store

We store the identity you sign in with, your orders, your referral attribution,

your ledger entries, and any photo you upload for a visualisation. A photo is

mirrored to our own storage before it is shown, so it still displays after the

upstream link expires.

We do not store a card number, because we do not take cards. We do not store the

private key that controls a deposit address; only an account public key is kept on

the server, and each order receives its own derived address.

A photo is kept until you delete it from your account page. Deleting a photo

removes the stored objects and keeps the accounting record, so a charge can still

be reconciled after the image is gone.

A cart is held against an opaque cart id in an HttpOnly cookie, so the cart

survives a page reload and a browser restart. A session cookie is HttpOnly,

Secure, and SameSite=Lax, and it is backed by a server-side record that logout

deletes.

We share a shipping address with the carrier that fulfils the order, and nothing

else. A partner sees the network volume their referees generated, not the contents

of a referee's orders.