Privacy

This is the complete list, taken from the database rather than from memory.

If you have an account: your email address, and a name if you gave one. Your password is never stored by this site — it is held, hashed, by our authentication provider, and this application never sees it.

If you have ordered: the order itself — its number, the lots, the price each was sold at, the totals, the delivery address you gave, the postage method, any tracking number, and the times at which it was placed, paid and sent. Payments record the method, the amount and the provider’s reference.

Card details: none. No card number ever reaches this site. Payment is taken by the provider you choose at checkout, on their own systems.

In your browser, not with us: your cart, your saved items and your saved searches are kept in your own browser’s storage. They are not sent to us and we cannot see them. Clearing your browser data clears them.

To sell you something and send it to you. The address is needed to post the parcel; the email address to reach you about the order and tell you when it ships; the record of what was sold at what price to keep an account of the sale, which a dealer is obliged to keep.

There is no advertising here, no profiling, and nothing is sold or passed to anyone except the parties needed to complete your order — the payment provider you chose, and the postal or courier service carrying the parcel.

An account lasts until you ask for it to be deleted. Orders outlive the account: deleting an account detaches it from its orders rather than erasing them, because a record of a completed sale is something both sides may need years later, and tax rules generally require it.

To be completed: the retention period for order records, which follows from the tax rules where the business is registered — commonly five to ten years.

You can ask for a copy of what is held about you, ask for a correction, or ask for your account to be deleted. Your order history is visible to you at any time in your account.

To be completed: the email address these requests should go to, and — if selling to the United Kingdom or the European Union — the supervisory authority a complaint can be made to, which depends on where the business is established.

One cookie, and only once you sign in: it holds your session so that the site knows it is you between pages. It is marked HttpOnly, which means no script on the page can read it, and it is removed when you sign out.

There are no advertising cookies and no third-party trackers, which is why there is no consent banner. Analytics are built but switched off: no measurement script is loaded, no request is made to one, and the content security policy for this site does not permit either. This page says so now rather than after the fact, as it promised.

The site runs on Cloudflare. The database and the account system are Supabase. Payment is handled by the provider you choose at checkout. Each holds only what it needs to do its part.

To be completed: the email provider, once one is chosen, and the countries where these services store data — which matters for buyers in the UK and EU.