Privacy

What we collect

blamejs.shop is an open-source ecommerce framework reference deployment. Every visitor request is processed through Cloudflare's edge network and a Cloudflare Worker we operate. The Worker logs the minimum required for operating the service: timestamp, request method, path, response status, and Cloudflare-assigned ray ID. We do not set any tracking pixel, fingerprinting beacon, or third-party analytics tag on the site.

If you submit the newsletter form, we store the email address you provide so we can send release notes. The address sits in a sealed-storage record encrypted with XChaCha20-Poly1305. We do not share it with anyone.

If you create a cart or place an order, we persist a session identifier (shop_sid) in a sealed HTTP-only cookie scoped to this domain. The cookie carries no profiling data — it is the lookup key for your in-progress cart row.

What we share

Order payments are processed through Stripe. The Stripe SDK runs on the checkout page; Stripe sees the card number, billing address, and amount. We never see the raw PAN. Order metadata (line items, shipping address, fulfilment status) lives in our database and is shared with no third party except as required to ship the order.

What you can ask us to do

You can request export or deletion of every personal record we hold about you by emailing privacy@blamejs.shop. The framework's compliance-export primitive produces the same shape an EU data-subject access request expects. We honour deletion requests within the timelines mandated by GDPR (one month), the California CCPA, and equivalent statutes in your jurisdiction where applicable.

Changes to this policy

This policy is versioned in source control alongside the framework code. Material changes ship with a release note and the "Last updated" date above moves forward. The full revision history lives in the project's git log.