The short version
I collect what I need to take your order, ship it to you, and answer your questions. It is kept in the EU on Craft Cloud or my managed hosting partner. I do not sell it, share it with advertisers, or pass it to data brokers.
What I collect
When you place an order: your name, billing address, shipping address, email, phone (optional), and what you ordered. Card details never touch my servers; Stripe handles payment and I only see a tokenised reference.
When you sign in: your email and password (hashed). Avatar + display name are optional. I do not require any of the social-login dance.
When you contact me: the message you sent and the address you sent it from, so I can reply.
How long I keep it
Order data: seven years (UK tax law). Account data: until you ask me to delete it. Support tickets: two years from the last reply.
Your rights
You can export your data from the Your account page, or ask me to delete everything (the order trail is anonymised, not destroyed, so the tax records stay intact).
Cookies and tracking
I use one essential session cookie. Anything beyond that asks for consent first via the banner you saw on arrival. Analytics is opt-in.
Changes
If this policy changes materially, I will tell you on next sign-in. Minor edits (typo fixes) I do not announce.