Privacy Policy

What we collect

Account details you give us: your name, email address and a hashed password. We never store your password in a readable form.

Order details: shipping address, phone number if you provide one, and the contents and totals of each order.

Two cookies: one holding your signed session token, one identifying your shopping bag. Both are httpOnly, so scripts on the page cannot read them.

What we do not collect

We do not store card numbers. Payment details are handled by the payment processor and never reach our database.

We run no third-party advertising or analytics trackers on this site.

How we protect it

Passwords are hashed with bcrypt. Sessions are signed JSON web tokens delivered over httpOnly, SameSite cookies, and sent only over HTTPS in production.

Every write endpoint is rate limited and origin checked, and every input is validated against a strict schema before it reaches the database.

Your rights

You may request a copy of your data or ask us to delete your account at any time. Write to privacy@bagonsales.shop and we will respond within 30 days.

Deleting your account removes your profile, addresses, reviews and wishlist. Order records are retained where tax law requires it.