// legal
Privacy policy
Last updated: August 20, 2026
Draft — not legal advice
A starting template, written to be reviewed by a lawyer before the store takes real payments. It has not been checked against US federal or state law.
Still missing in src/lib/legal.ts: address, state, venue
What we collect
When you buy: your email address, what you bought, the amount and the time. We keep a record of which key was issued against which order.
If you create an account: your email, an optional display name, and a one-way hash of your password. We never store the password itself and cannot recover it — not even to help you.
Automatically: a session cookie if you sign in, a cart cookie holding product identifiers and quantities, and a short-lived record of failed sign-in attempts with the originating IP address, used only to block password guessing.
What we never see
Card numbers, expiry dates and security codes are entered on Stripe or PayPal's own pages and never reach our servers. We receive only whether a charge succeeded, the amount, and a reference number.
Why we hold it
- To deliver your key and let you find it again later.
- To handle refunds, replacements and support requests.
- To meet tax and accounting obligations.
- To prevent fraud and abuse of the store.
Who it is shared with
Stripe and PayPal take payment. Resend delivers your receipt. Vercel hosts the site and Neon hosts the database. Each processes data on our instructions only.
We do not sell personal information, and we do not share it for advertising.
How long we keep it
Order records are kept for 7 years to satisfy tax rules. Failed sign-in records are deleted after 24 hours. Cart cookies expire after 30 days. If you close your account we remove your profile but keep the order record with the account link severed, because the record of a sale is not ours to delete.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete anything we are not required to keep. Write to keydexaa@gmail.com and we will respond within 30 days.
California residents have additional rights under the CCPA, including the right to know what is collected and to opt out of any sale of personal information — we do not sell it. [Confirm CCPA and other state-law obligations with counsel].
Cookies
Two cookies, both strictly functional: one holds your cart, and one holds a random session identifier after you sign in. There are no advertising or analytics cookies, which is why you are not being asked to dismiss a consent banner.
Children
The store is not intended for anyone under 16, and we do not knowingly collect their information.
Questions? Contact support.