Privacy

• Your email address, so we can send a receipt and, if you use an account, sign you in.
• Your name, and your shipping and billing address, so the parcel arrives and the payment clears.
• Your phone number, because a courier may need it — for customs paperwork on a parcel leaving the country, or to reach you about a delivery that failed. Stripe collects it as a required field, so there is no way through checkout without giving one.
• What you ordered, what it cost, and what happened to it afterwards — a shipment and its tracking number, a return, a refund.
• The references Stripe gives us for your checkout and your payment, so a refund or a query can be matched to the right one.
• A cart token in a cookie, so the cart you left survives a reload. It identifies a cart, not you.
• A session cookie, if you sign in, and the single-use sign-in link we email you, until it is used or expires.
• A technical record of any error the site hits while you are using it, described under Errors below.
• Which pages you looked at, and the site or search that sent you, described under Measuring traffic below. No cookie, and nothing that recognises you next time.

That is the whole list. We never see or store your card number — payment details go straight to Stripe.

We use PostHog to count how many people reach the shop, which pages they look at, and which site or search sent them. We need that to know whether anybody is finding us at all — until now we could see how many carts converted and had no idea how many people came and left.

It is set up without cookies. Nothing is written to your device, there is no third-party cookie, and no consent banner, because there is nothing to consent to storing. The consequence is real and it is on our side: we cannot tell a returning visitor from a new one. We took that trade deliberately rather than ask every visitor to dismiss a box.

It runs through our own domain rather than loading from PostHog’s, so your browser makes no request to a third-party origin while you are reading this site. There is no advertising pixel, nothing is shared with an ad network, and we do not record your screen or your typing.

We do, first. One person runs this shop, and that person can look up everything listed above against your order — what you bought, your email address, the address and phone number the parcel needs, and, if you have an account, the account itself. That has always been true; it is how an order gets packed and a support email gets answered. Not your card number, which goes straight to Stripe and never reaches us.

Then, outside this shop:

• Stripe processes payments and handles card details, which never reach us. It is also what collects your address and phone number at checkout, and passes them back to us.
• Postmark delivers our email — receipts, despatch and refund notices, and sign-in links.
• Fly.io hosts the site and Neon hosts the database.
• Cloudflare stores and serves the product photographs. It sees requests for images, not orders.
• PostHog receives the page views described above. No cookie, no name, no email — and it is reached through our domain, not yours to theirs.
• Whoever carries your parcel, who needs the delivery address and, for a parcel crossing a border, the phone number with it.

We do not sell your data, and we do not share it with anyone else.

When something goes wrong on the site we record the error and the page it happened on, so it can be fixed. That record is technical and is not used to build a profile of you.

Orders are kept as long as we need them for accounting and for honouring returns and faults. Carts that are never checked out are not useful to us and are not kept indefinitely.

Email orders@cshell.ink to see what we hold about you, correct it, or ask us to delete it. We have to keep records of completed orders for accounting, so a deletion request removes what is not legally required.