Account: your name and email address. Your password is handled by our sign-in provider and never reaches us.

Your sign-up form: your date of birth, phone number, and your home address. The date of birth is used only to check that you are 21 or older. If you are under 21, the sign-up is refused and nothing from that attempt is stored.

Your agreement record: when you create an account you type your full name as a signature and tick the agreements. We keep your typed signature, the time, the version and a fingerprint (SHA-256 hash) of the exact text you agreed to, and the IP address and browser details (user agent) the sign-up came from.

Orders: the order request itself, plus the name, email, phone, shipping address and billing address copied from your account at the time, and any note you add.

Chat: the messages you and the shop send each other.

Cart: if you add items to a cart, a random identifier in a cookie lets us keep that cart for you.

Email records: for the emails we send you about your orders, we keep the recipient, subject and delivery status.

We do not collect payment card details, bank details, government ID documents, health information, your precise location or biometric data.

To confirm you are 21 or older and are buying for research use, as set out in the Terms.

To process your order requests, contact you about them, and ship accepted orders to you.

To answer your questions and send you emails about your orders. These are service emails about your orders, not marketing.

To keep the store secure and to prevent abuse and false information.

To keep a legal record of what you affirmed when you created your account.

This site never takes payment. An order is a request, and payment is arranged directly with the seller, so no payment data passes through this site.

We do not sell your personal information. We do not use advertising trackers, analytics tools or session recording.

We use only what the site needs to work. One is the cookie that keeps your cart. The other is your sign-in session cookie, set by our sign-in provider. Because both are strictly necessary, there is no cookie banner.

The shop sees your name, email, phone, addresses, orders and chat, because it needs them to answer and fulfil your requests. People who help ship accepted orders see your name, email, phone and addresses for those orders.

We use these service providers to run the store. They process data on our behalf:

Clerk: accounts, email addresses, names and sign-in sessions.

Resend: sends our emails, so it handles email content, recipients and delivery events. Order emails contain order details and your name.

Railway: hosts the site and the database that holds everything described above, and keeps request logs.

An S3-compatible storage provider: holds product images. It does not hold your personal data.

We do not share your information with anyone else except where the law requires it.

Account details, your sign-up form and your chat messages are kept for as long as your account exists, and are deleted when your account is erased.

Your agreement record is kept for the life of your account. When it is erased we first remove the typed signature, IP address and browser details.

Orders are the seller's business records and are not deleted. If you ask us to erase your data, your name, email, phone, note and addresses are removed from your orders and the order itself remains without them.

A cart from a visitor with no activity is kept for up to 90 days. Email delivery records are kept for up to 180 days.

You can ask to see the data we hold about you, correct it, export it, or have it deleted. You can also object to how we use it or ask us to limit it. If you are in the EU or UK, these rights come from GDPR, and we apply the same approach to everyone.

To make a request, reply to any of your order emails. Self-service controls are not built yet, so we handle requests by hand. You can also complain to your local data protection authority.

Traffic to the site and to our database is encrypted in transit (TLS). Sign-in credentials are held by our sign-in provider, and stored secrets such as mailbox access tokens are encrypted. Access to shop data is limited to the shop owner and approved staff.

No system is perfectly secure. If a breach affects your data we will tell you and the relevant authorities as the law requires.

The store is for people aged 21 and over. We do not knowingly keep information about anyone younger.

We may update this policy. The date at the top shows when it last changed. If we make a significant change we will say so on the site.

Questions about privacy: reply to any of your order emails.