Privacy Policy

1. Data we collect

We collect only what we need to run the shop.

• Account data: when you sign in with Google we receive your name, email address and profile picture.
• Order data: products bought, order number, amount, status, time, and a receipt link. We do not receive or store your card details; Stripe handles payment.
• Messages: what you write to the seller through the chat, linked to your account.
• Cart and favourites: saved in your browser, and a cart snapshot (product IDs only) is stored so we can understand abandoned carts.
• Download activity: which products you can download.
• Technical data: IP address and request details, used for security, rate limiting and fraud prevention.
• Analytics: only if enabled and only with your consent, Google Analytics 4 collects usage data such as pages viewed and approximate location. It is currently off unless you opt in.

2. Why we use it, and our legal basis

• To provide the service and deliver your purchase (performance of a contract).
• To keep the site secure and prevent abuse and fraud (legitimate interests).
• To answer your messages and give support (contract and legitimate interests).
• To meet tax, accounting and legal duties (legal obligation).
• To measure and improve the site through analytics (your consent, which you can withdraw).

3. Who processes your data

We share data only with service providers who help us run the shop, under their own privacy terms:

• Supabase: database, authentication and file storage.
• Cloudflare: hosting, network delivery and security.
• Stripe: payment processing, fraud prevention and card receipts.
• Google: Sign in with Google, and Google Analytics where you consent.
• Resend: transactional email, when email sending is enabled.

4. We do not sell your data

We do not sell your personal data and we do not use it for third-party advertising.

5. Cookies and local storage

We use only what is needed to run the shop:

• Sign-in cookies (set by Supabase, named sb-...-auth-token) keep you signed in after you choose Sign in with Google. They are essential and are set only when you sign in.
• Browser storage (localStorage) on your device remembers your cart, favourites and shop preferences. It is not sent to advertisers.
• Preferences cookie (fc_prefs, one year): if you allow it, it remembers your last shop filters, your chosen edition and which tips you closed, so the site is as you left it. It is first-party and never shared. The cookie banner stores your choices in fc_prefs_consent and fc_analytics_consent.
• Optional analytics: if we switch on Google Analytics, it stays off until you allow "Analytics" in the cookie banner, and you can change your choice later with the "Cookie choices" button. Rejecting does not limit your use of the site.
• We do not use advertising or cross-site tracking cookies.

5a. Third-party cookies at payment

When you pay, you are sent to Stripe's secure checkout page, which sets its own cookies under its own policy.

6. International transfers

Our providers may process data in countries other than your own, including the United States and the European Union. Where required, they rely on recognised safeguards such as standard contractual clauses.

7. How long we keep data

We keep account and order records for as long as your account is active and as long as needed for tax, accounting and legal purposes. Chat messages are kept so we can support you. Technical security logs and rate-limit records are kept for a short time and then deleted. You can ask us to delete your data sooner, subject to legal retention requirements.

8. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or CCPA), you may have the right to access your data, correct it, delete it, restrict or object to its use, receive a copy, and withdraw consent at any time. To exercise a right, message us through the "Contact the seller" button while signed in. We may need to verify your identity first. You can also complain to your local data protection authority.

9. Security

We use encryption in transit, access controls, row-level security on our database, private file storage and rate limiting to protect data. No system is perfectly secure, so we cannot guarantee absolute security.

10. Children

Our service is not for anyone under 18, and we do not knowingly collect data from children.

11. Changes

We may update this policy. The version on this page applies from the date shown above.