Privacy policy

What we keep

• Your account: the username you chose. Passwords and recovery codes are stored only as one-way hashes (PBKDF2); we cannot read them.
• Orders: products, quantities, amounts, discounts, when you ordered and paid, the delivery (encrypted), and the country or region Cloudflare saw when you ordered.
• Payments: the USDT network, transaction ID, sending wallet address and amount. These are public on the blockchain anyway.
• What you write to us: after-sales messages and screenshots, reviews, feedback and wishes, and the name and one contact you give in a business inquiry.
• Abuse limits: IP addresses are kept only as a keyed hash (HMAC), to limit sign-in and sign-up attempts, and deleted after a day.
• Browsing totals: only how many times each product was viewed per day and how often each search term was used, never by whom. Search terms that look like emails or phone numbers are not kept.

What we do not collect

• Email addresses, phone numbers, real names, postal addresses or identity documents.
• Your passwords for other services, or any wallet private key or seed phrase. We will never ask for them.
• The site has no ads, third-party trackers or analytics, and loads no JavaScript.

Why

• To run your account, handle orders, confirm payments, deliver and give after-sales support.
• To prevent fraud and abuse, for example by limiting attempts.
• To answer your after-sales requests, feedback and inquiries.
• To order the shop by totals, so popular products are easier to find.
• Never to send advertising, and never sold or rented to anyone.

Cookies

• __Host-rl_session: keeps you signed in, 30 days.
• __Host-rl_cart: your cart, 30 days.
• rl_ccy: the display currency you chose, 1 year.
• They serve this site only, never tracking or advertising.

Who handles the data

• Cloudflare: hosting and security; it sees your IP address and connection details.
• Supabase: the database, stored in Singapore.
• Blockchain data services (TronGrid, BNB Smart Chain and Polygon nodes): to read public transfers to our addresses.
• The owner's Telegram alerts: only the order number, product, quantity and amount.
• Nobody else, unless the law requires it.

How long

• Accounts and orders: while the account exists; order records also serve after-sales, disputes and accounting.
• Business inquiries: deleted once handled, or after 180 days at most.
• Abuse limits one day; search term totals 90 days; daily view totals 400 days (no personal data).

Security

• Codes and deliveries are stored encrypted with AES-256-GCM; the key is not in the database.
• HTTPS everywhere; the admin needs a password and an authenticator app, and every full view of a delivery is logged.

Your rights

• You may ask to see or get a copy of your data, to complete or correct it, to stop its use, or to delete it.
• When an account is deleted, we replace the username with a meaningless code, switch off sign-in and delete your notices; orders, payments and after-sales records stay (no longer linked to an account anyone can sign in to) for later after-sales or disputes.
• A public review can be hidden on request.
• You cannot buy without an account, because deliveries live only in your account.

Contact us through the contact page with your username and an order number with its amount (or the payment's transaction ID), so we can check it is you. When this page changes, the date above changes; important changes are announced on the site. Contact →