What is collected

What is recorded about a visit

• The page that was opened, where the visitor came from, and when.
• What the browser said it was — its user agent, the size of the window, the language it asked for and how far its clock is from UTC.
• How long the page was actually on screen, how far down it was read, and whether a pointer or keyboard was used at all.
• That a link, button or field was used, what it was labelled, and where a link led — never what was typed.
• The network address the visit arrived over.

What is never recorded

• The contents of anything typed into a page. Whether somebody used a form is a signal; what they wrote in it is not, and is never sent.
• No session recordings, no screen captures, no keystrokes.
• No canvas, no font list, no audio probe, no high-entropy device hints — nothing whose purpose is recognising the same person somewhere else.
• No cookies, and nothing stored on the visitor's device.

How a visit is identified without an identifier

Visits are grouped by a key worked out from what was observed, rebuilt with a fresh secret every day. It groups one day's activity and cannot be turned back into a person, matched to yesterday's key, or used on anybody else's website.

How long any of it is kept

• The visitor's network address: erased by the store itself once 72 hours have passed.
• Everything else about a visit: 12 months.
• The verdicts and their reasons: 12 months.
• Your own account details, for as long as you have an account, and 30 days after it is closed.

What is worked out and kept instead

Before the address is erased, we take from it roughly where the visit came from — the country, the state or region, usually the nearest sizeable town, and who owns the network. Those are kept; the address is not.

Country and town data by DB-IP, used under a Creative Commons licence. Network ownership from iptoasn.com.

Read the privacy policy, which says what your rights are about all of this.