Legal

Privacy policy.

What this site collects, why, where it goes, and what you can do about it. Written by a human, not a lawyer — but every word is true.

v3.1 Last updated · May 12, 2026 · Reading time · ~6 min

01 Introduction

This is the privacy policy for redlintu16.com ("the site"), operated by a person who goes by RedLintu16, based in Helsinki, Finland. The site is small. The policy is short. If anything here ever changes meaningfully, you'll see the version number above tick up.

TL;DR — this site collects the minimum needed to run a store and a newsletter, never sells your data, and lets you delete everything any time with one email.

02 What we collect

Three buckets:

CategoryWhatWhy
AccountName, email, hashed password, optional phoneTo run your account & ship your orders
OrderItems, addresses, last 4 of card, fulfilment statusTax records (kept 7 yrs) & support
Site usagePages viewed, anonymised IP, referrerTo know what works. No third-party tracker.

We do not collect: location, browsing history outside this site, ad IDs, device fingerprints, or anything else you didn't hand over directly.

03 How we use it

Strictly for running the site:

  • Fulfilling your orders (sharing the shipping address with Printful / Printify only).
  • Sending transactional email (order receipts, password resets) via our own SMTP.
  • Sending newsletter emails — but only if you signed up, and unsubscribing is one click.
  • Detecting and blocking abuse (failed logins, scraping).

That's the entire list. No profiling, no remarketing, no sale or transfer of your data to advertisers.

04 Cookies

This site uses three cookies. All first-party, all functional:

NamePurposeLifetime
rl16_sidSession ID (login, cart)30 days
rl16_csrfCSRF protectionSession
rl16_themeLight / dark preference1 year

05 Third-party services

  • Google & GitHub — optional sign-in. If you use one, we receive your name, email address and avatar URL from that provider and store them on your account. We never see your password there, we request only basic profile and email access, and we never post anything on your behalf. Revoking access in your Google or GitHub security settings stops the connection immediately.
  • Stripe — processes payments. Sees your card and billing address.
  • Printful & Printify — fulfil physical products. See your shipping address and order contents.
  • Listmonk (self-hosted) — newsletter sending. Only your email, only if you signed up.
  • Hetzner — our hosting provider. Sees standard server logs (anonymised IPs, request paths).

06 Your rights

  • Access — request a copy of everything we have on you.
  • Correction — fix anything that's wrong.
  • Deletion — delete your account & data (tax-required order records get anonymised, not removed).
  • Export — download your data as JSON.
  • Object — opt out of the newsletter at any point.

Email [email protected] from your account email and we'll handle it within 7 days.

07 Data retention

Account data lives as long as your account does. Order records are kept for 7 years for Finnish tax law. Newsletter subscribers are removed instantly on unsubscribe. Server logs roll over after 30 days.

08 Children

This site is not directed at people under 16, and we don't knowingly collect data from them.

09 Contact

Privacy questions: [email protected]. For everything else, [email protected] works.

Want a copy of your data?

If you have an account, the export is one click from your profile.

Get the next post in your inbox.

Occasional notes on what I'm building, what I'm listening to, and what just broke in production.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.