publication status
this draft requires review and replacement with an approved privacy policy before publication. it makes no claims about what data shoebill collects, stores, or shares.
information still needed
the final policy should be based on the actual website, account, payment, and support systems. it should explain:
- what information is collected and where it comes from
- why each category is used and the applicable legal basis
- which service providers receive data
- how long information is retained and how it is deleted
- whether cookies or similar technologies are used
- how visitors can exercise privacy rights and contact shoebill
current site behavior
account registration stores a username, email address, password hash, and the time the terms were accepted in PostgreSQL. passwords are not stored in readable form. sign-in uses a necessary, HTTP-only session cookie that expires after 30 days. password reset tokens are stored as hashes and expire after 30 minutes. HMAC-derived keys based on the connecting address limit repeated account requests. if email recovery is enabled, the reset email is sent through the configured SMTP provider. this site does not process payments or issue licenses.
before launch
confirm the production data flows, replace this draft with approved language, and link the final policy wherever account or checkout features are offered.