Privacy
This site is a side-project run by one person from Adelaide. We collect the minimum we need to take your order, stay in touch about it, and understand how the site is used. We don't sell your data and we don't run ad-tech.
What we collect
When you place an order, Stripe (our payment processor) collects your name, email, and shipping address — we store the email and the address details we need for fulfillment. We never see or store your card details.
When you ask for a magic-link login, we send the link to the email you provide and store the email against any past orders.
Analytics. We measure visits from our own web server logs and a small script served from this site. We use no cookies and no third-party analytics service. Our web server records your IP address, browser, each page you request (including order and account pages) and the page you came from, and keeps those logs for 90 days before deleting them; secret links such as order and download links are blanked in them before they are written. A separate error log, kept for 14 days, can still record such a link if our site fails to respond to it. From the logs we keep, for each visit: the pages viewed and when, a code derived from your IP address and browser that changes every day, your approximate location (city and network), and your browser and device. This is pseudonymous, not anonymous: at our small volume, those details together can point to one person. After 90 days we remove the city and the exact network, keeping only the network's type (home, data centre, privacy relay or unknown), along with country, region, browser and device. We look at visits one at a time as well as in totals, and we use AI tools to help us read them; those tools work mostly from the stored records described here, and when we build and check the analytics itself we also use them on the server logs, which hold your IP address. If you buy something, the visit is marked as a purchase. Traffic from bots is reduced to daily counts after 90 days.
Our script reports the page you viewed and whether your browser is being driven by automation software. If your browser sends Global Privacy Control, the script does not run and we leave your visit out of our analytics; the web server log still records the request, as above. Pages that carry personal links — your orders, invoices, downloads, checkout and account — don't load the script at all.
Where your data goes
- Stripe processes payments and stores card details. Hosting: United States and Ireland. See Stripe's privacy policy.
- Amazon Web Services (SES) sends transactional emails (order confirmations, magic links). Hosting: Australia (Sydney region). They keep delivery metadata.
- Linode (Akamai) Object Storage stores uploaded files (digital downloads, product images). Hosting: Singapore.
- Analytics: our own server; no third-party analytics service.
- AI tools we use to read our analytics and logs receive the records described above. Hosting: United States.
That's the full list. We don't share with anyone else and we don't sell your data.
Cookies
We set a cart cookie when you add something to your cart (30 days), a security cookie that protects our forms (a day), and a session cookie when you log in (if you choose to). Stripe sets cookies on the checkout page for fraud detection. Our analytics use no cookies. There's no advertising or tracking cookies.
How long we keep things
Identifiable order records (with your name and address): at least 5 years from the transaction date, per ATO record-keeping requirements. After 5 years we may anonymise the personal details while keeping the order record itself for accounting.
Anonymised order records: retained indefinitely as business records. They contain no personal information about you.
Magic-link tokens: 30 minutes (single use; deleted on use).
Session cookies: 90 days, sliding.
Analytics: as described above: server logs for 90 days; the visit records without your city or exact network are then kept indefinitely. Backups of the analytics can hold these records for up to three weeks after they are deleted.
What you can ask us to do
Email us at orders@findingsimple.com and we'll:
- Export the order and account details we hold about you
- Anonymise your details on past orders (your name, address, and email get blanked; the order records themselves remain for accounting)
- Tell us to stop sending emails (other than transactional ones for orders in progress)
- Find or delete your analytics records. Within 90 days of a visit we can find its records if you tell us your IP address, your browser and roughly when you visited; we will tell you what we found and delete them on request. Deleting them removes the stored visit records; the server logs and backups described above are not edited and expire on their own schedule.
Updates
If we change this policy, the new version goes live here. Material changes get a note.
Contact
Email us — we'll respond personally.