Skip to main content
Defiance International

Legal

Privacy policy

Defiance International keeps its data practices honest and minimal. This policy describes exactly what we collect and store today, and, just as importantly, what we do not.

At a glance

  • We set only strictly-necessary cookies, a signed session cookie and a CSRF token.
  • First-party analytics runs only after opt-in consent; advertising and third-party trackers are not loaded.
  • Passwords are hashed; sessions live server-side and can be revoked instantly.
  • Payments are handled by external payment service providers. We retain only the order and transaction information needed to complete and fulfill your order.
  • Data-subject requests go through the support form and are handled manually.

Cookies and tracking

We use strictly-necessary cookies only: a signed session cookie that keeps you logged in, and a CSRF token that protects forms from cross-site request forgery. Both are first-party and essential to operating the store.

Optional first-party analytics is consent-gated and posts only to our own analytics endpoint after you opt in. We do not load advertising, fingerprinting, or third-party trackers.

Access metadata and site integrity

To operate and protect the site, we may log and review technical access metadata, including source IP address, browser or device information, request path, date and time, response status, and approximate region. We use this information to protect site integrity, prevent abuse, troubleshoot service issues, and understand site performance.

Account data

Your account is your email and credentials. Passwords are hashed, we never store them in plaintext and cannot read them. Sessions are stored server-side and can be revoked instantly.

Orders and payments

Payments are handled by external payment service providers. We retain only the order and transaction information needed to complete and fulfill your order, meet legal obligations, prevent fraud, and resolve disputes. We do not sell order data.

COA verification logging

When a Certificate of Analysis is verified by QR or code, we log the scan and write a chain-of-custody event so a lot's integrity history is auditable. The public verification endpoint is anti-enumeration and third-party lab street addresses are stripped from public certificates.

Your rights

From your account privacy page you can download a portable copy of your data and request erasure. Erasure runs on a 30-day cooling window; retained accounting and legal records are anonymized where required. You can also reach a person through the support form.