Privacy Policy
Last updated 9 September 2026. These terms are provided in English.
The short version: we ask for an email address so we can send you the file you
bought, we keep the details you type in order to draw your star map, and we count visits
using storage in your own browser. There is no advertising pixel on this site, no
third-party tracker, and no IP-address geolocation. If any of that changes, this
page changes first.
1. What we collect, and why
| What | Why | Where it lives | Kept for |
|---|
| Your email address (given at checkout) |
To deliver your file and to answer support or refund requests |
Our database and our payment provider |
As long as needed for support and for the records tax law requires |
| The details you enter on a card — names, a date and time, a place,
a message, and any photograph you upload |
To compute the sky and render your file. This is the product |
Your browser, and our database once a design is saved |
Until you ask us to delete it, or the design is removed |
| Payment details |
To take the payment |
Never with us. Handled entirely by Paddle |
See Paddle's policy |
| Usage events — which page or design was viewed, and the steps of
the checkout funnel |
To understand what people find useful, and what is broken |
Your browser's local storage, and our database |
Most recent 3,000 events per browser; older ones are discarded automatically |
| Your language choice |
So the site opens in the language you picked |
Your browser only |
Until you clear your browser storage |
2. What the analytics actually record
Once per session we record a single context row: an approximate country,
your time zone, your browser's language, whether you are on a phone, tablet or desktop,
which browser and operating system, the site that referred you, and a rough bucket for your
window width. Then, as you move through the site, we record which design you looked at and
which step of the funnel you reached.
Country comes from your device's time zone, not your IP address. We do
not use an IP geolocation service and we do not store IP addresses for analytics. That
makes our own numbers less precise than a typical analytics tool — a deliberate trade.
Two identifiers make the counting work:
- a random session id in
sessionStorage, which exists only
for that browser tab and disappears when you close it;
- a random visitor id (
sk_vid) in
localStorage, so we can tell a returning visitor from a new one.
Neither contains your name, your email, or anything that identifies you personally, and
neither is shared with anyone or used to follow you across other websites.
Cookies
This site sets no cookies. The storage described above is
localStorage and sessionStorage in your own browser, which you can
clear at any time from your browser settings. If our hosting provider ever supplies a
country hint of its own, we would read it to improve accuracy — and would say so here first.
Turning analytics off
You can opt out of all usage analytics for this browser. This also deletes the events and
the visitor id already stored here.
3. Who else touches your data
We keep this list short on purpose, and it is complete:
- Paddle (Paddle.com Market Ltd) — our payment provider and merchant of
record. It receives your email and billing details in order to take payment, issue your
receipt, and handle sales tax. Paddle is its own data controller for that; see
Paddle's privacy notice.
- Supabase — the hosted database that stores designs, prices and usage
events. Our project runs in the European Union (Frankfurt).
- Our website host — serves the pages, and keeps short-lived server logs
for security and abuse prevention, as any web host does.
We do not sell your data. We do not share it for advertising. There is no Google
Analytics, Meta pixel, or similar on this site today; if we add one before running ads, this
page will say so and will explain your choices before it goes live.
4. Legal basis (UK/EU visitors)
- Performing our contract — your email and card details, so we can
deliver what you bought.
- Legitimate interests — aggregate usage analytics, to run and improve a
small business, and basic security logging. You can opt out above.
- Legal obligation — keeping transaction records for tax purposes.
- Consent — anything else, asked for at the time and withdrawable.
5. International transfers
Our database is hosted in the EU. Paddle is in the United Kingdom. The person who runs
Nightward is in Lebanon and administers the service from there, which means
data may be accessed from outside the EEA/UK. Where transfers require a safeguard, we rely
on the standard contractual clauses our providers operate under.
6. Your rights
Wherever you live, you may ask us to show you what we hold, correct it, delete it, or
stop using it — and if you are in the UK or EU you also have rights to restrict or object to
processing and to receive your data in a portable form. Email
joseph.f.tossy91@gmail.com and we will reply
within 30 days.
You do not need to ask us to stop analytics — use the button above. If you are in the
UK or EU and think we have handled your data badly, you may complain to your national data
protection authority.
7. Children
This site is meant for adults buying gifts, and is not directed at children under 16. We
do not knowingly collect their data. If you believe a child has given us personal
information, tell us and we will delete it.
8. Security, and being straight with you
Access to the database is restricted by row-level security rules and to authorised
accounts; payment data never reaches our systems. No service can promise perfect security,
and we will not pretend otherwise: if a breach ever affects your data, we will tell you and
the relevant authority as the law requires, rather than quietly.
9. Changes
If this policy changes we will update the date at the top. Changes that affect what we
collect or who receives it will be flagged on the site itself, not just here.