Every field we hold, where it came from, and when it goes.
Not a privacy policy. A list. Twenty-two things an account can contain, each with its source, its retention period and whether you can delete it without closing the account.
Everything an account can hold.
Things you told us
- Name
- You. Kept while the account exists
- Email address
- You. The primary identifier, kept while the account exists
- Delivery addresses
- You. Kept until you remove them, or seven years if used on an order
- Phone number
- You, optionally. Deletable without closing the account
- Your parish
- You, or derived from a postcode. Changeable at any time
- Six stated preferences
- You. Beats every inferred signal in Suggesting
- Notification settings
- You. Twelve switches and a quiet-hours window
Things you did
- Order history
- The three tills. Seven years, because tax law says so
- Check-ins
- The wallet. Which site and when. Never where you were
- Bushel ledger
- Every earn and burn. Seven years alongside the orders
- Holdings — patches, casks, boxes, fosters
- The relevant system. Permanently, because a provenance record that expires was never a record
- Which chapters you have read
- This site. Deletable on its own, and about one member in twenty does
- Badges and streaks
- Derived. Deletable, and deleting them deletes the achievement
- Support correspondence
- You and us. Two years
Things we worked out
- Which accounts across the three tills are you
- Matched on email, then confirmed phone, then card fingerprint
- Suggested products
- Derived nightly from the six signals. Recomputed, never archived
- Your seasonal score
- Derived. Resets in October
- Whether you have passed an age check
- A yes or a no and a date. Never your date of birth
Things we deliberately do not hold
- Your date of birth
- The age check returns a yes or a no. We keep the answer, not the input
- Card details
- Never. This build takes no payment at all
- Precise location
- The parish is the finest resolution anywhere in this system
- Anything from a data broker
- Nothing bought, nothing enriched, nothing appended
This is a demonstration build and holds none of the above. The list describes what a live version would hold, which is a more useful thing to publish than a page saying we hold nothing.
The retention clock, by kind.
| Kind | Kept for | Why that long |
|---|---|---|
| Orders and the money attached to them | Seven years | HMRC. Not our choice and not negotiable |
| The bushel ledger | Seven years | It is attached to the orders |
| Provenance records for a holding | Permanently | A record that is deleted when you stop buying was never a record |
| Check-ins | Two years | Long enough for the streaks, short enough to be uninteresting |
| Support correspondence | Two years | Long enough to remember the last conversation |
| Reading history | Until you delete it | It is yours and nothing depends on it |
| Marketing consent | Permanently, as a record | We keep proof that you said no, so nobody asks again |
The matching, and the two times we got it wrong.
Joining three tills into one account means deciding that three customers are one person. We do it on email address first, then on a phone number that has been confirmed, then on a card fingerprint, and never on a name alone.
It has gone wrong twice. Once a household shared an email address and two people’s orders merged, which was noticed within a fortnight and unpicked. Once a phone number had been recycled by a network and a new owner briefly saw a stranger’s check-in history, which was noticed within four days and is the reason phone numbers now have to be confirmed rather than merely present.
Both are on this page rather than in an internal incident log, because a matching system that has never been wrong is a matching system nobody has looked at properly.
Export it
One file, machine-readable, everything above, within thirty days and usually within one.
Delete it
Two taps. Thirty days to change your mind, then it is gone.
Never sold
Not to a broker, not to a partner, not to anybody, under any circumstances.
See the matches
Every till account we have joined to yours, listed, with a button to separate them.
Your data, questioned.
Yes, under UK GDPR, and it is a button rather than an email address that takes a fortnight. The law allows a month; the button usually takes a day.
Reading history, badges, streaks, phone number and old addresses, yes, individually. Orders, no, for seven years, because tax law requires it.
No. Not to brokers, not to partners, not aggregated, not anonymised, not ever. It is the shortest paragraph on this page for a reason.
The data would go with the business, which is what always happens, and you would be told before it did rather than afterwards.
Take it with you.
One file, everything in it, and a format somebody else can actually read.
First sight of every drop
The things that sell out do it in minutes. This is the only warning anyone gets.
