1. Why This Page Exists
You are trusting this store with account credentials and money. This page says what we actually do about that, so you can judge it rather than assume it.
2. Your Account
- Passwords are stored hashed, never in a form anybody here can read.
- Sessions are held in an HTTP-only cookie that JavaScript cannot reach.
- What you are allowed to do is resolved from the database on every request, not from your session token — so access removed is access removed immediately, not when a token expires.
3. Delivery Data and Secrets
- Delivery data is shown only to the buyer who owns that order.
- Licence keys and account credentials are encrypted at rest.
- Secrets are never written to logs, never put in a URL, and never cached by a shared cache.
- Verification documents and dispute evidence live in private storage. There is no public link to one, and every time a reviewer opens one it is recorded against their account.
4. Money
- Every movement is a row in an append-only ledger. Balances are derived by summing those rows, so there is no stored balance that can quietly disagree with its own history.
- A mistake is corrected by a reversing entry, never by editing what happened.
- Payments are confirmed from the payment provider's own signed notification, never from a browser redirect.
- Repeated or replayed provider notifications cannot pay anybody twice.
5. What You Should Do
- Use a password you use nowhere else, and turn on two-factor authentication.
- Never send a payment to an address somebody gives you in a message. We will never ask you to.
- Check an item as soon as it arrives, while the warranty period is open.
6. Reporting a Vulnerability
If you believe you have found a security problem, write to the store email address with enough detail to reproduce it. Please give us a reasonable chance to fix it before telling anybody else.