Privacy Policy

Last updated October 11, 2026

What we collect, and why

• When you buy: your email address, what you bought, the amount, and the checkout reference from Stripe. We use these to deliver your files, run your library and keep business and tax records. We count downloads per file to stop link sharing.
• When you open your library: your email address and IP address, kept about 24 hours to limit sign-in requests. Sign-in links are stored only in scrambled (hashed) form.
• When you join the email list: your email address, where you signed up, and when you confirmed or unsubscribed. Your IP address is kept about 24 hours to stop abuse of the sign-up form.
• When you email us: your message and address, to answer you.

We never see or store card details. Link, Stripe’s checkout service, handles payment as the merchant of record under its own privacy policy.

Cookies and analytics

We set one cookie, and only when you sign in to your library: a signed session cookie that keeps you signed in for 30 days. There are no advertising or tracking cookies. Our visitor statistics use Cloudflare Web Analytics, which counts page views without cookies and without identifying you.

Who else handles your data

• Stripe and Link: payments, tax, receipts, refunds and fraud prevention. As the merchant of record, Link handles your payment details under its own policy (above).
• Cloudflare: website hosting, our order and email-list database, file storage, email forwarding, visitor statistics, and technical error logs, which can include an email address and are kept up to 7 days.
• Resend: sending our emails (download links, sign-in links, list letters).
• Google (Gmail): our support inbox, where emails you send us and replies to our emails arrive.

These providers are based in the United States, so your data may be processed there. We don’t sell or rent your data, and we don’t share it with advertisers.

Email list

You join only by confirming through the email we send, and buyers are never added automatically. Every letter has an unsubscribe link. When you unsubscribe we keep a record of your address marked “unsubscribed”, so we never email you again by mistake.

How long we keep it

• Orders: as long as you might want your library, and as long as tax and accounting rules require.
• Email list: until you unsubscribe (then only the “unsubscribed” record). Sign-ups that are never confirmed are deleted after 7 days.
• Sign-in links and sign-up rate-limit logs, including IP addresses: about 24 hours.

Your choices and rights

Wherever you live, you can ask us to show you, correct, or delete the data we hold about you, or to stop using it. Write to hello@thegmssatchel.com. We may keep order records the law requires us to keep. If you’re in the EU, EEA or UK, we rely on contract (to deliver what you bought), consent (for the email list) and legitimate interests (keeping the site secure and counting visits), and you can complain to your local data protection authority.

Children

This site isn’t aimed at children under 13 (under 16 in the EU), and we don’t knowingly collect their data.

Changes

If we change this policy we’ll update the date at the top of this page.