Privacy Policy: what changed

v8.0 · 2026-09-25 to v11.0 · 2026-10-01

AI summary

AI-written reading aid: changes between these versions. The linked published versions are the authoritative text.

Adds optional Cloudflare performance measurement on homepage, catalog, blog and policy pages after a fresh analytics opt-in, cookieless and separate from Google Analytics.
Notes Cloudflare still processes the network request, lists excluded buyer, contact and recovery routes, and says coverage is partial.
Describes provider retention and report availability as Cloudflare's own descriptions, not a deletion guarantee.
Describes the staff rehearsal token as kept in local storage and copied into a tab, with that browser's analytics marked test traffic and excluded from reports.
Replaces the introductory callout with a separate AI summary reading aid.

Wording changes

~~Removed text~~ is struck through; added text is underlined. Unchanged paragraphs are omitted. Link destinations appear in brackets.

Privacy Policy In short. This site has no accounts and nothing to log in to. It collects personal data when you fill in a form — to make an offer, buy a domain, refer a buyer, or contact us. For offers, purchases and referrals, it records where the request came from. Email we send you about an offer or a purchase records whether it was opened and which links were clicked. Both are for online fraud prevention, both are described below, and both are read by a person. A phone number you choose to leave with an offer is checked once, and is texted about that offer only if you tick the box asking for texts — reply STOP and it is not texted again, and no mobile information is ever shared for marketing. If you asked about a domain anywhere but the contact form, or bought one, we may email you a discount code for similar domains; every such email has a link that stops them, and a stop is permanent. The pages also load analytics and advertising scripts from Google on eligible static pages, with independent choices for analytics and advertising. Buyer and recovery pages do not load those scripts. Everything else on the page works without knowing who you are.

Cloudflare — serves every page, delivers our email, and runs the security checks in front of them. Processes your IP address and request metadata as part of delivering the site, and derives from the address the country, region, city, and network operator we store, as described in Section 2. With your analytics choice, it also receives the performance measurements described in Section 4.

Cloudflare Web Analytics can measure the homepage, catalog, blog, and policy pages after a fresh analytics opt-in. This is a cookieless measurement script, separate from Google Analytics. It records page loading and interaction timing, layout stability, page and referrer addresses, browser/device information and country, and diagnostic information about page elements and resources involved in those timings. Cloudflare processes the network request needed to receive those measurements; this is not a claim that no IP address is processed in transit. We do not send form fields, account details, messages, or purchase credentials to this measurement service. We exclude domain purchase pages, contact and referral forms, receipts, checkout and recovery routes, previews, and staff test sessions. A query string or fragment in the page address prevents loading, as does a referrer containing parameters or an unapproved path. Search terms are not added to measurements. The script does not measure single-page navigation. Existing Google-only grants require a new choice before this added service can run; an explicit refusal of both purposes is preserved. Measurements cover only visitors who opt in and eligible pages, so they do not represent every visitor or every purchase flow. Cloudflare documents seven days of unsampled beacon data, followed by sampled aggregation, with reports accessible for the previous six months. These are provider retention and report-availability descriptions, not a promise that every provider copy is deleted on those dates. We keep no separate raw visitor-measurement database. See Cloudflare's measurement documentation [https://developers.cloudflare.com/web-analytics/faq/].

An operator test token in local storage, copied into a tab's session storage ~~during~~when that tab loads one of our pages, only in a browser our staff use for rehearsals, kept until they end the session. It is sent with rehearsal requests to distinguish tests from real purchases, and while it is present, analytics from that browser is marked as test traffic and excluded from our reports.

All effective dates are stated in Coordinated Universal Time (UTC).