Privacy policy
This policy covers the personal information CodedCart handles as a Canadian business subject to PIPEDA. It describes what the application actually stores rather than every category we might conceivably collect.
Who is responsible
CodedCart is operated by CodedCart, Ontario, Canada. Write to support@codedcart.com about an order or privacy@codedcart.com about your personal information.
What we collect
Account information: your name, handle, email address and date of birth, and optionally a phone number and profile picture. Date of birth is collected only to confirm you are 18 or older. If you sign in with Google, Apple, Facebook, X or GitHub, we receive your name and email address from them and nothing else.
Order information: what you bought, what it cost, the delivery address you give on the payment page, and the status of the payment. Card details go directly to Stripe and never reach our servers.
Security and activity information: sign-in attempts, password changes, administrative actions on your account, with the IP address and browser they came from. This is what lets us tell your sign-in from someone else's.
Content you submit: listings, reviews, and support messages you send us.
Why we use it
To run your account and show you your own orders, cart and saved items; to get orders delivered; to detect fraud and payment abuse; to keep the tax records Canadian law requires us to keep; and to work out which parts of the store are failing people.
We do not sell personal information, and we do not run advertising trackers on this site.
Who we share it with
Sellers receive what they need to fulfil your order - your name, delivery address and what you bought. They do not receive your email address, your payment details or anything about your other orders.
Stripe processes payments. Our hosting and email providers process data on our behalf under contract. We disclose information to law enforcement only where legally required, and we record it when we do.
Stripe also receives your delivery address, to calculate sales tax. Fonts, scripts and images on this site are served by us, so no other third party learns that you visited.
Children
CodedCart is for adults. Accounts cannot be created by anyone under 18, and if we learn we hold a child's information we delete it.
We only email you about your account and your orders: verification, password resets, sign-in codes and order updates. We send no marketing, so there is nothing to unsubscribe from. If that ever changes it will be opt-in, and every message will carry a one-click unsubscribe link.
The mobile app
The app collects the same information as the website and nothing more. It contains no analytics, advertising or crash-reporting SDKs.
Your sign-in is kept in your device's secure storage (Keychain on iOS, Keystore on Android) and removed when you sign out. Payment and social sign-in open in your device's browser, so the app never sees your card or your Google, Apple, Facebook, X or GitHub password.
How long we keep it
Order and payment records are kept for seven years, because Canadian tax law requires it - these survive a deletion request, with your name reduced to what the record needs.
Security and activity logs are kept for twelve months and then deleted automatically, including after you close your account, so that a sign-in by someone else can still be investigated. Everything else - profile details, cart, saved items - is deleted when you close your account.
Your rights
You can ask for a copy of what we hold, correct anything wrong, or have it deleted. You can delete your account yourself from the security page, on the website or in the app; for anything else write to privacy@codedcart.com. We answer within 30 days.
If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada.
Cookies and security
We only use cookies the site cannot work without, listed in the cookie policy. There are no advertising or analytics cookies, so there is no consent banner to dismiss.
Passwords are stored hashed, never in a form we can read. All traffic is served over TLS, and you can end every other session from the security page in your account.