Legal
Privacy Policy
Last updated: 2026
This policy explains what information we collect, how we use it, and the choices you have.
Information we collect Information you provide at checkout and when contacting us (name, email, shipping address, order details), and limited technical data such as device type, pages viewed, and referring website.
If you accept analytics (see below), we also generate a random visitor and session identifier stored in your browser, and record any campaign parameters present in the link you arrived through (for example utm_source, utm_medium, utm_campaign, or a click identifier appended by an advertising platform). These are used to understand which marketing efforts lead to orders. They are not linked to your name or email except through an order you actually place.
How we use it To process and fulfill orders, verify payments, provide support, send transactional messages, prevent fraud, measure how the site and our marketing perform, and comply with legal obligations. We do not sell your personal information.
Analytics and advertising technologies Analytics is off until you accept it. If you decline, no analytics identifiers are created and no analytics events are sent.
When you accept, five things run: our own first-party analytics, which records page views and store events to our own database; Vercel Analytics, a privacy-focused measurement service provided by our hosting provider; the TikTok Pixel; the Snap Pixel; and the Reddit Pixel.
**The TikTok Pixel.** We advertise on TikTok, and the pixel is how we measure whether those adverts work. If you accept cookies, it loads on our pages and sends TikTok your page views along with the technical data any web request carries — IP address, browser and device type, referring page — and an identifier TikTok stores in your browser. TikTok uses this to report advert performance to us and, in line with its own privacy policy, for its own purposes including advert targeting.
It also reports shopping actions: which product pages you view, when you add an item to the cart, when you begin checkout, and when an order is paid. For those events it receives the product identifier, quantity, price, the order value and the currency. It does not receive your name, your address, or the contents of any message you send us.
**One identifier, on one page.** When an order is confirmed as paid, we send TikTok a one-way SHA-256 hash of the email address used for that order. The hash is generated on our server, so your actual address is never handed to code running in your browser and never reaches TikTok. Its purpose is to let TikTok match the purchase to the advert that led to it. A hash cannot be reversed back into an email address, though anyone already holding the same address could confirm a match — so treat it as pseudonymous rather than anonymous. This happens only on a paid order, and only if you accepted cookies. You can ask us to stop it at any time using the contact details above.
**The Snap Pixel.** We also advertise on Snapchat, and this pixel does the same job for those adverts. It loads only if you accept cookies, and it sends Snap the same shape of information: your page views, the technical data any web request carries, an identifier Snap stores in your browser, and the same shopping actions — product viewed, added to cart, checkout begun, order paid — with the product identifier, quantity, price, order value and currency. Snap uses this to report advert performance to us and, in line with its own privacy policy, for its own purposes including advert targeting.
Snap is treated exactly as TikTok is on the point that matters most: your raw email address and phone number are never sent. On a paid order — and only then — Snap receives a one-way SHA-256 hash of each, generated on our server, so the actual values are never handed to code running in your browser and never reach Snap. Snapchat's own setup instructions offer a field for the plain address; we do not use it, and our code refuses to send anything that is not already a hash. Everything in the paragraph above about what a hash is and is not applies here in the same way.
We do not send Snap your age or your location. The pixel is initialised with our advertising account's public identifier and nothing about you.
**The Reddit Pixel.** We also advertise on Reddit. This pixel is narrower than the other two: it loads only if you accept cookies, and it reports your page views together with the technical data any web request carries — IP address, browser and device type, referring page — and an identifier Reddit stores in your browser. Reddit uses this to report advert performance to us and, in line with its own privacy policy, for its own purposes including advert targeting.
It reports shopping actions too: which product pages you view, when you add an item to the cart, and when an order is paid. For those it receives the product identifier, the quantity, the value and the currency. It does not receive your name, your address, or the contents of any message you send us. One difference from the other two: we do not tell Reddit when you begin checkout, only when an order completes.
**If you are signed in, Reddit also receives a hash.** Reddit calls this Advanced Matching, and it is how it links a visit to an advert you saw. When you are signed in to an account and have accepted cookies, we send Reddit a one-way SHA-256 hash of your email address and a second hash of your internal account number. Both are generated on our server, so your actual address is never handed to code running in your browser and never reaches Reddit. Reddit's own setup instructions offer a field for the plain address and will hash it in your browser instead; we do not use it, and the hash we send is identical either way. Signed out, or browsing as a guest, nothing identifying you is sent at all.
A hash cannot be reversed back into an email address, though anyone already holding the same address could confirm a match — so treat it as pseudonymous rather than anonymous. This is the same treatment TikTok and Snap already receive, with one difference worth stating plainly: for those two it happens only on a paid order, whereas Reddit receives it on page views while you are signed in. You can stop it at any time by declining cookies, signing out, or asking us using the contact details above.
If you decline cookies, none of these three pixels are loaded at all. No request is made to TikTok, Snap or Reddit, no identifier is set, and none of the three receives anything about your visit.
**The Google Ads tag works differently, and this is the one place our answer is not "nothing loads".** We also advertise on Google, and Google's tag (gtag.js) is present on every page rather than appearing only after you accept. What your choice controls is not whether it loads but what it is permitted to do, using Google's consent mode.
**Before you accept — and permanently, if you decline — every storage permission is set to denied.** No advertising cookie is written. No identifier is stored in your browser or sent to Google. Nothing is shared for ads personalisation. What Google does receive is a single cookieless signal that a page was viewed, carrying the technical data any web request carries — IP address, browser and device type, referring page — with nothing tying it to you, to your other visits, or to any advert. We are telling you this plainly rather than describing the tag as switched off, because it is not.
**If you accept**, those permissions are granted: Google may then store an identifier in your browser and use your page views to report advert performance to us, to build the remarketing audiences our adverts are shown to and, in line with its own privacy policy, for its own purposes. If you accept and later change your mind, the permissions are set back to denied straight away, in every tab.
Either way the tag is the narrowest of the four on what it is told. It does not report shopping actions at all: we do not tell Google which product pages you view, when you add an item to the cart, when you begin checkout, or when an order is paid, and it receives no product identifier, quantity, order value or currency. Nothing identifying you is sent at any consent setting. Google's own setup offers a field for your email address, under the name Enhanced Conversions; we do not use it, so Google receives neither a plain address nor a hash of one.
We do not run a Meta pixel or any advertising technology beyond the four named above. If we add one, this policy and our Cookie Policy will be updated to name the platform, the data shared and the purpose before it is switched on — as they were for the Google tag above.