Privacy

The promise

No trackers, no data sales, no lists but the one you join. There is no analytics, no advertising and no third-party script on any page; the public pages set no cookie at all. Nothing about you is sold, rented or scored for anybody else. Card details never touch this site: you type them into Stripe, and Stripe keeps them.

What is held

An account. The email address you sign in with and when you first did. The six-digit code and the sign-in link are kept only as hashes and expire after ten minutes; whichever is used first retires the other. A signed-in browser carries one cookie, good for thirty days. Sign-in attempts are counted against a hash of the address and a hash of the network they came from — neither is stored as itself — and those counters are thrown away about an hour later.

Orders. What you bought, what you paid, the name and address it shipped to, the carrier and tracking number once it is on its way, and the Stripe identifiers that tie the order to the payment. Also a Stripe customer id, which is how Stripe knows you the next time — never a card number, never an expiry, never a security code; those go to Stripe and stay there.

Subscriptions. A mirror of what Stripe holds about a subscription you started: its state, its price, when it renews, when it was cancelled. Stripe is the record; this is the copy that lets your account page say so.

Support. The tickets you open on your account page and every message on them, and the mail that reaches support@alphazerocomplex.com or the store’s other addresses. Inbound mail is kept as it arrived, including its headers, so a reply can be threaded to the right conversation and a person can read what you actually sent.

The marketing list and its consent. If you give an email address to one of the forms on this site, we keep the address, which form it was, what was offered, the day, and the version of the words you ticked. Every marketing email carries a one-click unsubscribe, and an address that unsubscribes is not written to again. Your account page has the same switch.

What we sent you. A ledger of every email this site sent to your address — the confirmation, the shipping notice, a reply on a ticket — so your account page can show it and so nothing is sent twice.

Logs. The operational record of requests, kept for thirty days and then deleted. It never holds a sign-in code, an email address, a card detail or an order’s contents.

Cookies

Two, both necessary, and only once you sign in: one that says a sign-in is under way, and one that says you are signed in. Both are signed, sent only over HTTPS, and unreadable by script. Stripe’s checkout page is Stripe’s own site, with Stripe’s cookies, and you leave it the moment you have paid.

Who sees it

The people who run Alpha Zero Complex see the records their roles reach: whoever handles orders sees orders, whoever answers support sees tickets, and nobody sees a card.

Stripe processes the payment. It sees your card, your email, the shipping address you type into its page and the amount, under Stripe’s own privacy policy. Its customer portal is where a subscription is changed or cancelled.

Supliful packs and ships the bottle. It is given your name, the shipping address and what to send, and it hands back a tracking number. It is not given your email address for its own use, and it is not given your card.

Amazon Web Services hosts it, in the United States: the records in a database table, the mail in a private bucket with no public address of its own. Email is sent and received by Amazon SES from addresses of ours. Beyond these, Alpha Zero Complex discloses what it holds to nobody, or where the law leaves no choice.

How long

Sign-in codes and links last ten minutes; a session lasts thirty days; the counters behind the rate limits last about an hour; logs are deleted after thirty days. Orders are the store’s books and are kept for as long as books must be. An address on the marketing list that never bought anything is redacted after two years. The words of an email we sent you come off the ledger after two years; that it was sent stays. A ticket and its mail are kept while the account stands, or until you ask.

Asking

To see what Alpha Zero Complex holds about you, to have a copy of it, to correct it, or to have it deleted, write to support@alphazerocomplex.com. Say enough to find it — the email address you ordered with, an order number — and a person will answer. Deleting an account does not delete the books an order is written in; it does delete everything else.

Alpha Zero Complex. support@alphazerocomplex.com