Privacy Policy

Last updated: September 2, 2026

This policy explains how Thearith's Shop (“we”, “us”) handles personal data when you use this website (the “Site”). We aim to collect only what we need to run the Site and to be clear about what happens to your information.

Who is responsible

The data controller for this Site is Thearith's Shop. For privacy questions or requests, contact us at sokunthearithmakara@gmail.com.

What this Site does

The Site lets you browse public product listings, view details, and follow links to external checkout or demo pages. You do not need an account to browse listings. If you have purchased a product, you may optionally sign in with the email address used at checkout so we can show your dashboard. Sign-in uses a one-time link sent to that email; we do not store a password for this Site.

Data we process

Depending on how you use the Site, we may process:

• Technical and usage data — such as IP address, browser type, device information, pages viewed, and timestamps. This is collected automatically in standard web server and security logs when you load pages or call our API.
• Analytics data — through Google Analytics, we collect information about how visitors use the Site, such as pages visited, time spent, referring website, approximate location derived from IP address, browser and device characteristics, and interactions with the Site. Google Analytics uses cookies and similar technologies to recognise your browser or device across visits. We use this data in aggregated form to understand traffic and improve the Site.
• Search and filter preferences — if you use search or filters, your choices may appear in the page URL. These are used to show relevant listings and are not stored in a user profile on this Site.
• Listing content — product titles, descriptions, images, and metadata supplied by our catalogue backend. This is public catalogue information, not personal data about you.
• Sign-in email — if you use Log in, we process the email address you enter to check it against purchase records from Buy Me a Coffee (stored on our linked Moodle site) and, when it matches an active purchase, to send you a one-time sign-in link. We store a hashed copy of that link token and, after you sign in, a hashed session token bound to this browser for up to one hour (extendable while you keep using the Site, and for no more than 24 hours). Your dashboard reads purchase quantity, activation status, and download access from Moodle at request time; we do not store purchase or activation details in the shop database.

We do not use advertising cookies on this Site. Browsing does not require an account. Optional passwordless sign-in is only for people who already purchased a product.

Cookies and analytics

Sign-in uses strictly necessary cookies (shop_device, shop_session, and shop_csrf) to keep you signed in on this device, prevent cross-site request forgery, and bind the session to this browser. These are not analytics cookies.

When you browse the Site, we load Google Analytics to measure visitor traffic and site usage. Google Analytics may set cookies such as _ga and related identifiers to distinguish visitors and remember visit information.

You can also control cookies by:

• changing your browser settings to block or delete cookies;
• installing the Google Analytics Opt-out Browser Add-on;
• using browser privacy features or extensions that limit tracking.

Blocking analytics cookies may not affect core browsing on the Site, but we will receive less information about how the Site is used.

Third parties

When you use the Site, data may also be processed by:

• Google Analytics (Google) — we use this service to measure visitor traffic and site usage. Google may process the analytics data described above on our behalf. Google’s privacy information is available at policies.google.com/privacy. Analytics data may be processed in the United States and other countries where Google operates.
• Content delivery networks — for example Google Fonts, jsDelivr, and jQuery CDN, which deliver stylesheets and scripts. Those providers may receive your IP address and browser information when your device requests those resources.
• Our catalogue backend — the Site loads public listing data from our API layer. Sign-in also asks that backend whether the email you entered has an active purchase.
• External checkout and demo sites — if you click “Get it”, “See demo”, or similar links, you leave this Site. Those third-party sites have their own privacy policies and may collect personal data such as payment or account details.
• Email delivery — sign-in links are sent through the SMTP account configured for this Site (for example Gmail). That provider processes the recipient address and message content in order to deliver the email.

Why we use this data

We process personal data where necessary to:

• provide and maintain the Site;
• let purchasers sign in without a password and access their dashboard;
• secure the Site and prevent abuse;
• understand how visitors use the Site and improve its content and performance;
• measure aggregate traffic and fix errors;
• comply with legal obligations.

Under UK GDPR / EU GDPR, we rely on legitimate interests to measure aggregate traffic and improve the Site, and to operate a secure public catalogue. We rely on legal obligation where applicable.

How long we keep data

Server and security logs are kept only as long as needed for security, troubleshooting, and legal compliance, then deleted or anonymised. Unused sign-in links expire after 15 minutes. Signed-in sessions last one hour of activity and at most 24 hours, then the session cookies and stored hashes are removed. Data collected through Google Analytics is retained according to our Google Analytics account settings (typically up to 14 months, unless configured otherwise).

Your rights

If UK GDPR or EU GDPR applies to you, you may have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete data in certain circumstances;
• restrict or object to certain processing;
• data portability, where applicable;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local data protection authority.

To exercise these rights, use the contact details above. We may need to verify your request before responding.

International transfers

Some third-party providers listed above may process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses or equivalent protections.

Children

The Site is not directed at children under 16, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this page from time to time. The “Last updated” date at the top will change when we do. Continued use of the Site after an update means you accept the revised policy.

← Back to listings