Privacy

This store was built to hold as little about you as a shop that mails parcels can. This page is the full inventory, not a summary of one.

Who is responsible

BuxAPI Merch is the controller of the data described here. Privacy questions go to our Discord server, which is the only contact route this store has.

Ask in our Discord

There is no email address in this system

Not an optional field, not one we promise never to use. The database has nowhere to put one. An account is sixteen digits, and we store a keyed hash of those digits rather than the digits themselves, so the account row identifies nobody. That single decision is what removes most of what a shop normally knows about a customer, and it has a cost you should understand before you spend money: losing your number means losing the account, its balance and its order history permanently, because we hold nothing that could prove the account was yours.

What we actually store

Everything the store keeps, in full:

The account

A hash of your sixteen digit number, your balance in US cents, and the date the account was created.

Shipping details, once you order

The name, street, city, state or region, postal code and country you typed at checkout, plus a phone number if you gave one and a note if you wrote one. The phone number exists because couriers ask for one on international parcels, and it goes to the printer with the rest of the label. The note is free text, so whatever you put there is what we hold.

The order itself

Which items, the size where an item has one, quantities, prices, the total, whether it was paid from balance or by invoice, the invoice id, the tracking number once it ships, and the timestamps for created, paid and shipped.

The ledger

One line per balance movement: top-ups, order payments and refunds, with amounts and dates.

Deposit addresses

The blockchain addresses issued to your account for top-ups, and a record of which deposits have already been credited so that none is credited twice.

That is the whole list. The database has nowhere to put a date of birth, a company, a marketing preference, a password or a customer profile, because those columns were never created.

Cookies

One cookie, named merch_session. It holds your account id and a signature that proves the id came from us, which is what keeps you logged in for thirty days. It is HTTP-only, so scripts on the page cannot read it, and it carries no secret you could lose by leaking it.

That cookie is strictly necessary for a shop to work, so there is no consent banner here. There is nothing else to consent to: the store loads no analytics, advertising pixels or embedded widgets, and every typeface it uses is one already on your device, so no font server sees your visit either.

Your IP address

Account creation and login are rate limited per IP address, which is what stops someone generating accounts in bulk or guessing at numbers. The counter lives in the server's memory, holds a count and an expiry, and is discarded when the window ends. It is never written to the database and never joined to an account or an order. Our hosting provider keeps its own request logs, as every host does.

Who else sees any of it

The print provider (Printful)

They receive your shipping address and the items to make, because they print the parcel and post it to you. They do not receive your account number, your balance or your payment details.

The carrier

Chosen by the printer for your region. They get the address on the label.

The payment platform (BuxAPI)

It sees the deposit addresses issued to your account, the amounts, and the invoice totals. It never receives your shipping address or your name.

We do not sell any of this, and we do not hand it to advertisers or data brokers. We would hand it over to a court or a regulator with the authority to demand it, which is not a promise anyone can honestly make differently.

The part we cannot make private: the chain

Crypto payments are recorded on public blockchains. Anyone can read them. The amount, the timing and the address that paid are permanently visible, and a chain analysis firm can often link a paying wallet to whatever else that wallet has done. This is a property of the payment method rather than something the store chose, and no policy of ours can delete it. If that matters to you, think about which wallet you pay from.

How long we keep it

Account and order records stay while the account exists. Bookkeeping copies of orders and payments are kept for as long as tax and accounting law requires them, after which they go. Rate limit counters last minutes. The deposit ledger stays because it is what proves your balance is correct.

Your rights, and the honest catch

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete the account and its rows. The catch is identification. We know you as a number we cannot read, so an email claiming to be a customer proves nothing, and acting on it blindly would be the privacy problem rather than the fix.

What works in practice: most of the data is already on screen when you log in, on the account page and the order pages. For deletion, message us in our Discord with an order number and the shipping name on it, which is something only you and we know. We will delete the account, its addresses and its cart, and keep the minimum bookkeeping record the law requires. Deleting an account with a balance forfeits that balance, because there is no way to send it anywhere.

Never send us your account number, by email or any other route. We will never ask for it, and anyone who does is not us.

Changes

If what the store collects changes, this page changes with it and the date at the bottom moves. Complaints about how we handle any of this can go to the data protection authority where you live.

Last updated 26 August 2026.