Privacy

What the message form collects

There is one form on this site. It sits on the home page, the visit page, each department and town page, and under every piece that has not sold, and it is the only place you are asked for anything about yourself. Sending it stores four things.

Your name

As you typed it, up to 80 characters.

A phone number or an email

One box, whichever you would rather be reached on, up to 120 characters. Nothing checks which it is.

Your message

Up to 2,000 characters, kept as you wrote it.

Which piece you were looking at

Only when you send from a piece's own page, and only so the reply knows what it is about.

Alongside those it records the moment you sent it, and later, whether it has been opened. The form also has a box your browser does not show you, which catches automated spam. Whatever a machine puts in that box is thrown away and never stored.

What else the site writes down

Sending the form records the IP address your connection is using, so the site can turn away more than five messages an hour from the same place. It is written to a separate table, it is not attached to your message, and a job that runs every night clears it once it is more than a day old.

Opening a page or looking at a photograph writes nothing down. Narrowing the stock by department or price writes nothing down either. Typing words into the search box writes nothing down when something comes back.

One case does write something: you type words, and nothing on the shelf matches them. Then the site saves the words and the time, so the booth can see what people are asking for and not finding. It also writes the IP address your connection is using into the same one day table the message form uses, and for the same reason: to stop one machine filling that list. The two are written together, so they can be matched up. It is cleared once it is more than a day old by the job that runs every night. No name and no address is attached to either one.

What the site does not do

There is no analytics on this site. No tracking pixel, no advertising tag, no session recorder, no heat map, none of that in any page. Nothing follows you from here to another website, so a Do Not Track signal from your browser has nothing here to switch off. The site does not read it.

You are not given a cookie. The only cookies this site ever sets belong to the owner's control panel: one keeps him signed in, the other tells his own pages to show him an edit bar. Both are created after he signs in with a passkey, on his own device.

Nothing collected here is sold, rented, or handed to anybody for their own use. There is no mailing list and no newsletter, so a message to the booth does not sign you up to anything.

Who else is involved

Two companies, and it is worth being exact about both.

Cloudflare runs the servers. The pages, the database holding your message, and the photographs all sit on Cloudflare's network, and every request to this site passes through it, so Cloudflare keeps its own operational record of that traffic the way any host does. Nothing is sent to them beyond what running the site requires.

Google serves two of the typefaces. When a page opens, your browser fetches the lettering from Google's font service, which tells Google your IP address, which browser you are using, and that the request came from this site. That is the whole of it: there is no Google analytics and no advertising code anywhere here.

Who can read your message

Reaching the messages means signing in to the control panel with a passkey enrolled on a device beforehand. There is no password to guess and no way in from the public site. Your message is not published anywhere on this site and there is no page that lists it.

How long it is kept

Indefinitely, which is the honest answer rather than the careful one. Nothing in this site deletes an enquiry on a schedule. A message you send sits in the database until somebody takes it out by hand.

The database is copied to a backup every night, and those copies are kept on a ladder: all of them for the first fortnight, then one a week out to three months, then one a month out to 400 days. So a message taken off the site is still inside the backups that were made while it was there, and it is gone from the last of them within 400 days, as those copies age out on their own. Nothing reaches into an old backup to pull one message out of it, and a backup is opened only to put the whole database back after a disaster.

Asking what is held, or asking for it back

You can ask what is held about you, and you can ask for it to be deleted. Deleting takes the message off the site the same day, and it stops being in the nightly backups as those age out, on the 400 day schedule above.

The message form on the visit page is the way. It is the same form this page has been describing, and it arrives in the same place, so a request about an old message lands next to the message itself.

Say what you want done, and say enough for the message to be found again: roughly when you sent it, and the name or the phone or email you put in the form. Nothing here searches by contact details, so that is a person reading down a list.

If this page changes

Changes are made here, and the date under the heading changes with them. There is no mailing list to announce anything on, so this page is the whole record of what the site collects.