Privacy Policy
Sample template. This page describes what this software does with data and orders, as shipped. It is not legal advice: the store operator adapts it to their business and jurisdiction, and has it reviewed, before going live.
What we store
- Your account: your email address and the sign-in methods you use (email and password, Google or GitHub). With Google or GitHub, the name and profile picture they share are shown in the header while you are signed in.
- For email and password accounts, Firebase Authentication keeps your email, name, a one-way hash of your password and whether you confirmed the address. We never see the password itself.
- Your orders: the products, sizes, quantities and prices, the total, the status, your email address, the delivery address you enter on Stripe's Checkout page, and the Stripe references needed for refunds.
- Product reviews you write: the rating, title and text, shown publicly with your first name and last initial. Deleting your account deletes them.
- Your registry, if you create one: its name, event details and products. A public registry can be seen by anyone with its link.
- Seller enquiries sent from the Sell on Jonquil page: your name, business, email address and message.
- Anonymous view counts: when you view products, we count which products were viewed in the same visit, with no account, name or IP address attached, to show "also viewed" suggestions.
- Gift cards: the codes of the cards you buy, kept on your order; each card's amount, balance and status, filed under a one-way hash of its code; and, on an order you pay partly by gift card, the card's last four characters and the amount it paid.
Payments
You pay on Stripe's Checkout page. Stripe collects your card details and creates the invoice; Jonquil never receives or stores card numbers.
Services that process data for us
- Firebase (Google): Authentication for email and password accounts, and Firestore for accounts and orders.
- Stripe: payments, invoices and refunds.
- Google and GitHub, if you choose to sign in with them.
- Upstash: short-lived counters, keyed by account or IP address, that limit repeated sign-ins and checkouts. They expire within an hour.
- Our hosting provider, which may keep standard server logs such as IP addresses and the pages requested.
Cookies and browser storage
A session cookie keeps you signed in for up to 7 days. Your cart, saved-for-later items, list and browsing history are saved in your browser's local storage on this device; you can clear the browsing history or turn it off on the Browsing History page. We use no advertising or analytics cookies.
Your choices
Removing an order from your order list hides it there; the record is kept for accounting. You can delete your account on the Account page: your sign-in methods, your Firebase Authentication account and the address on your account record are removed, and your orders stay as the store's record of each payment. To have those orders deleted too, contact the store.