We keep as little as we can get away with

This covers hanicoloring.com, run by Nitrotech, Inc., a Delaware corporation, publishing as HaniColoring. It is written plainly because a privacy policy you cannot read is not really a policy.

What we keep when you buy

• Your email address, so we can send your download link.
• What you bought, what it cost, and the country your card was billed in.
• Which link brought you here, if you arrived from an advert or a post, so we know what is worth doing again.

What we never see

Your card number, and everything around it. Payment is handled entirely by Stripe on their own pages. Nothing about your card reaches our servers, so there is nothing about your card for us to lose.

Your downloads, and the thing we deliberately do not store

A download link is meant for one buyer, so we need to notice when one is being used from an unusual number of places. That needs a way to tell devices apart, which normally means keeping IP addresses. We do not keep them.

Instead, each address is put through a one-way hash with a secret salt before it is written down. The result lets us count how many different places used a link. It cannot be turned back into an address, not by us and not by anyone who took the database. We also record which book was downloaded and when.

The announcement list

You are on it if you signed up on the site or ticked the box at checkout. Buying alone never adds you. The list gets news of new books and, now and then, the books in the series you do not have yet: never more than one email a month. Every one carries an unsubscribe link, and leaving takes one click and no explanation.

Two days after any order we send one email asking whether the files printed properly, with your download link in it. That goes to every buyer, list or not, because it is about the order rather than about selling you anything; if you are not on the list it contains no offers.

Measurement and advertising

We advertise, so we measure whether the advertising works. Three companies help us do that, and each learns something about your visit.

• Google Analytics counts visits and which pages get read. It sets a cookie to tell a returning visitor from a new one, and receives your rough location, browser and device.
• The Meta pixel does the same for adverts on Facebook and Instagram, so we can tell which ones led to a purchase. It sets its own cookies and receives the pages you viewed and your IP address.
• The Whop pixel does the same for adverts we run through Whop. It receives your IP address and browser, and we tell it when you view a pack, start a checkout, join the announcement list, and complete a purchase. For a purchase it also gets the amount paid and an anonymous reference that stops one sale being counted twice. We never give it your email, your name, or which books you bought.

When you buy, we also send Meta a record of the purchase from our server rather than your browser, including your email address, name, and the city, state and postcode of your billing address, all in hashed form. Those are the details our payment processor has to collect to charge the right tax; we do not ask you for anything extra to send them, and we never send your street address or your card. Hashed means scrambled in a way that cannot be reversed back into the original, but it can still be matched against a Facebook account that gave the same details. That is the point of it, and it is the one place where something identifying you goes to a company that advertises. We say so plainly rather than bury it.

What we do not do: sell your data, hand your email to anyone in readable form, or use any of this to decide what you are charged.

Turning it off

There is no cookie banner on this site today. If you would rather not be measured, these work regardless of us: block third-party cookies in your browser, use its tracking protection, install Google’s opt-out add-on, or change your Facebook ad settings. You can also write to us and we will delete what we hold and ask Meta to delete their record of your purchase.

Who else touches your data

The companies needed to take a payment, store an order, send an email and measure our advertising. Each sees only what its job requires, and all of them are in the United States, so your data goes there.

• Stripe takes the payment and is the seller of record for it, which is why their name may appear on your statement alongside ours.
• Neon stores the order.
• Vercel runs the site and holds the book files in private storage.
• Resend delivers the email with your link.
• Google, Meta and Whop measure our advertising, as described above. Unlike the four above them, these three are not working only for us: what they learn about your visit also feeds their own advertising business.

How long we keep it

Your download link works for five years. We keep the order itself for longer, because tax and accounting rules require a record of what was sold and to whom. Download records are kept only as long as they are useful for spotting a shared link.

Having it removed

Write to us and ask. We will tell you what we hold, correct it if it is wrong, or delete it. The one thing we cannot delete is the record of a sale that tax rules oblige us to keep, and we will say so plainly rather than pretend otherwise. Deleting your email address also ends your download link, so we will check that you mean it.

If you are in the UK or the EU, those are rights you already have, and nothing here limits them.

Asking

Write to support@hanicoloring.com. A person reads it, usually within a day.