Privacy

Browsing the catalogue requires no account, no sign-up and no consent banner, because the site sets no advertising or analytics cookies. The hosting provider keeps short-lived access logs for security and abuse prevention; they are not used to build a profile and are discarded on the provider’s own schedule.

When you press Acquire, the request is recorded with the product, the region you are reading from, the moment of the request and an anonymous identifier. That identifier,ip_hash, is a SHA-256 digest of your IP address combined with a secret salt held only in the server environment. It is one-way: the address cannot be recovered from it, and it is not linked to any name, account or profile. Its only purpose is to count how many people ask for a given piece in a given region, and to detect automated abuse of the endpoint.

The raw IP address is never written to the database. Where a click is recorded for affiliate reporting, the record holds the region, the country derived from the connection, the referring page, the browser’s user-agent string and the same anonymous hash — never the address itself.

The club requires an account. Sign-in is passwordless: you receive a link by email, or you authenticate with Google when that provider is enabled. What is stored is your email address, your name if you supply one, the membership record returned by Stripe (status and renewal date), and a session cookie that keeps you signed in.

The session cookie is the only cookie this site sets for a signed-in member. It is HTTP-only, scoped to this domain, and expires with the session. No password is ever stored because no password exists.

Membership is billed by Stripe. Card details are entered on Stripe’s infrastructure and never reach this server. What the house keeps is the Stripe customer identifier, the subscription identifier, the price, the status and the end of the current period.

A sourcing request stores what you write in the form: the model or colourway you are looking for, the size, an optional budget and any notes. It is visible to you in the lounge and to the person who answers it. It is deleted when you close your account, or on request.

No advertising identifiers, no cross-site trackers, no fingerprinting, no session recording, no third-party pixels. If measurement is ever added, this page will state what it is before it is switched on.

Acquisition and click records: twenty-four months, then deleted. Concierge requests: twenty-four months after they are closed. Account and membership: until you ask for deletion, plus whatever period accounting law requires for the payment record. Deleting an account removes the membership and the concierge requests with it.

You can ask what is held about you, have it corrected, have it erased, receive a copy, or object to a specific use. Write to the address at the foot of this page and the request is answered within thirty days. Because the anonymous request data cannot be tied back to a person, it cannot be retrieved for you — that is the point of hashing it.

Neon hosts the database, Vercel serves the site, Stripe processes payments, and Google provides the optional sign-in. Each acts on documented instructions and is bound by its own data-processing terms. No data is sold, and none is shared with a partner boutique beyond what the retailer receives when you complete a purchase on its own site.

When this policy changes materially, the date at the head of the page moves. The current text always governs, and the terms of service state how the two documents fit together.