Privacy
The newsletter form stores your email, optional name, consent time and notice version, signup source, and subscription status in the store database. When email delivery is configured, we send a confirmation request through Resend. Your address is marked confirmed only after you confirm through that email; until then it is not eligible for product updates. We store confirmation time, token hashes, and the confirmation email sending status. Confirmation links expire after 24 hours. Local previews without email configuration save requests only and send nothing. A private unsubscribe link is included in confirmation emails, or shown after a new local preview signup; save it to withdraw your request. Duplicate signups do not reactivate unsubscribed addresses. Unsubscribe records are retained to prevent future sending. Administrators can view signup records. Anti-abuse counters use hashed IP/time buckets and expire after 15 minutes; they are cleaned up on later submissions. Cloudflare Turnstile is used when configured on the public site; the local preview does not run this check. For questions or data deletion requests, contact us through the WhatsApp link below. Before launch, this page must be updated to accurately describe analytics, checkout/payment providers, cookies, order data, support messages, retention, user choices and the legal/business contact information actually used by the store.
Website traffic measurement
We measure page views, referring domains, campaign labels, landing pages, approximate country and device type, and clicks on WhatsApp, add-to-cart and checkout buttons. A random visit identifier in session storage expires after 30 minutes of inactivity. We do not store raw IP addresses, full referring URLs, search queries or URL fragments in analytics. Records are retained for up to 90 days and expired records are removed when new traffic is recorded. Short-lived, hashed network identifiers limit abusive submissions. We respect browser Do Not Track and Global Privacy Control signals. Analytics measures visits, not identified people; click counts do not establish purchases or messages sent.