Privacy policy
All products are Dopamine · Nothing ships · No money needed. Nothing is bought or sold here, so we hold no payment data, card, mobile-banking number, NID, phone number, OTP, address or real name — and we never ask for any of them.
1. What lives in your browser (localStorage)
Your cart, order history, progress and settings stay in your own browser and are not sent to our server. The keys used are: language and theme (db_lang, db_theme), sound on/off (db_sound), the language the welcome message was last shown in (db_welcome), cart (db_cart), lifetime and monthly almost-spent totals (db_spent, db_items, db_checkouts, db_month, db_month_spent, db_food_spent, db_food_orders), collections and achievements (db_collection, db_achv, db_level_seen, db_couriers, db_carriers, db_hubs, db_cuisines, db_dishes_tried), daily quests and mystery boxes (db_quests, db_qday, db_box_day, db_box_count), imaginary orders and tracking (db_orders, db_track_recent, db_returns, db_chip_hide, db_tray), rider-call and notification choices (db_call_off, db_notif_no), how long this session has lasted (db_session_start), and a random device id (db_sid). If you have an account, only your username is kept in db_user to show it in the header — no password or login token is ever stored in localStorage.
To erase all of it: open the “Me” panel and press Delete all my data, or clear this site's data in your browser.
2. Cookies
Our code sets at most two cookies:
db_lang— which language you chose (Bangla or English); kept for 1 year.db_sess— only when you sign in; keeps you signed in. It is HttpOnly (page JavaScript cannot read it), lasts up to 180 days (extended when you use the site), and is removed when you sign out.
Advertising: there are currently no third-party ads or advertising cookies on this site — only our own links labelled “Sponsored”. If ads are ever enabled, this section will be updated first.
3. Accounts (optional)
Accounts are optional and exist only for the leaderboard; shopping, checkout and group orders all work without one. If you create an account we store: the username you choose (shown publicly on the leaderboard), your email address (used only for the account confirmation link and password-reset links you request — never marketing, never shared or sold), an Argon2id hash of your password (the password itself is never stored), when the account was created and last used, a count of failed logins (to stop brute force), one-way hashes of your sign-in sessions, and one-way hashes of confirmation and password-reset links (a reset link works once, for 30 minutes). No phone number and no OTP are collected.
For the leaderboard the server keeps your total almost-spent, monthly and daily figures, and one record per submitted checkout (product ids, quantities, the server-calculated total, the total your browser claimed, whether it looked suspicious, and a salted hash of your IP address). Your cart, order numbers and tracking data never reach the server.
4. Our own statistics (no cookies)
To understand how the site is used we count a few events ourselves: event type (e.g. visit, add to cart, checkout), page path, language, the random device id (db_sid), a short detail, device class (android/ios/desktop/other), the referring page (domain and path only, query removed) and utm tags. No user id and no IP address is stored with them, and no third-party analytics script runs on the site.
5. Contact form
Messages sent through the contact form keep the name, email address and message you enter, the language and a hash of your IP. Each message is also emailed to the site owner's private inbox so we can reply to the address you gave; it is used for nothing else. The form asks you to type a captcha (letters and numbers) to keep out spam — the captcha sets no cookie and uses no third-party service.
6. IP addresses
IP addresses are needed for rate limiting and to detect leaderboard fraud, but we never store them directly — only a SHA-256 hash mixed with a secret salt. Rate-limit counters reset within minutes to a day.
7. How long we keep things
- Statistics events: deleted automatically after 90 days.
- Leaderboard checkout records: deleted after 180 days (your total score stays with the account).
- Contact messages: deleted after 365 days.
- Application error logs: 30 days; they contain no passwords, sessions or raw IPs.
- Accounts: until you delete them.
8. Your controls
- Download: “Me” panel → “Download my data (JSON)” — everything we hold about you.
- Delete: “Delete account” — confirm with your password and the account, score, checkout records and all sessions are permanently removed immediately. No email to anyone needed.
- Change password and sign out on all devices — same panel.
9. Other organisations
The site is served through a content-delivery and security network (Cloudflare), which processes your IP address to deliver requests. An email service sends confirmation emails and delivers contact-form messages to us. We sell no data and build no advertising profiles.
10. Children
This is a general-audience entertainment site. We do not knowingly collect personal data from anyone; the whole site works without an account.
11. Contact
Privacy questions: info@buyeverything.top · Report a security problem: info@buyeverything.top