Privacy Policy
What we collect, why we collect it, and what you can ask us to do with it.
This policy is not finalised. The operator must have this page drafted or reviewed by counsel licensed in the District of Columbia before launch. The headings below are the sections this business actually needs; the text under each is a prompt, not a policy.
What we collect
Account records store name, email address, Telegram username, a scrypt password hash, an age-confirmation timestamp, and any review you submit. Order coordination happens in Telegram, which is a third-party service with its own policy.
Identity and age verification
Describe what ID data is collected at verification, who processes it, where it is stored, how long it is kept, and who can access it. This is the most sensitive data this business handles and the section most likely to be wrong by default.
Location data
The site checks the visitor’s approximate region at the network edge to decide whether to serve the storefront. It is evaluated per request and not stored.
Cookies and local storage
A session cookie holds sign-in state. The age confirmation is kept in sessionStorage and a session cookie. The cart is kept in localStorage in the browser.
Who we share it with
List every processor: the hosting provider, the Telegram Bot API, and any analytics or review integration added later.
How long we keep it
State a retention period per data type, especially for ID verification records.
Your rights and how to exercise them
Access, correction, deletion. Give a working contact route and a response time.
Security
Passwords are stored as scrypt hashes and never in plain text. Session tokens are stored hashed. Describe breach notification.