Privacy notice

Updated October 28, 2026. Optional website measurement is used only when enabled by Duncan Made and allowed by you.

Optional website measurement

If enabled, we ask before measuring your visits. Allowing measurement sets a first-party browser cookie lasting up to 30 days. We retain day-specific browser hashes and measurement times for 35 days. Measurement records do not store your IP address, page URL, or a link to your account. Browsers, devices and cleared cookies can count separately; these counts are not counts of people.

Use Privacy choices to decline or change your choice. Declining clears the measurement cookie and stops future measurements in this browser. Previously collected day-specific records are not automatically removed by that choice; they expire after 35 days. Your choice is stored in this browser's local storage without a set expiry. Global Privacy Control or Do Not Track disables measurement.

Reports and recipients

If reporting is enabled, browser activity counts and a private registered-account directory go through Resend only to duncanmadellc@gmail.com. When the account directory is enabled, reports include known verified account emails, optional supplied names and recorded creation dates, with unknown historical dates labelled. A CSV attachment contains the complete known directory. They contain no passwords, password hashes, tokens, orders, payment details or individual browsing records. Successfully sent report payloads, including any account directory, delivery status and identifiers are deleted from the website database after 90 days from confirmed sending. Pending, failed or review-state reports remain until operator reconciliation and currently have no automatic expiry. Cleanup runs at startup and about once a minute while the website service is running, including when optional measurement is off; it resumes after downtime. Copies held by Resend or in owner mailboxes follow their separate retention settings.

Sign-in and business records

Optional email sign-in uses Resend to deliver a verification code. Sign-in sessions last up to 30 days. Optional password sign-in uses a salted, memory-hard password hash; plaintext passwords are not stored. Setting or changing a password requires a fresh email verification. Requested reset links expire after 20 minutes and work once. Resend sends requested reset instructions and password-change notices. Password changes revoke other sign-in sessions and outstanding reset links. Security rate-limit records use keyed hashes rather than raw IP addresses, and expire after two days of inactivity. The website records optional profile names, verified email addresses and when they were observed; these account records and password credentials have no automatic expiry, including when optional measurement is off. Historical sessions or saved carts can establish an earlier verified login, but do not establish exact signup dates or a complete historical account count. Creation dates are recorded for new accounts explicitly registered and email-verified after creation tracking begins. Observation dates are never used as historical signup dates. Reset-token hashes are removed when consumed, superseded or expired; expired entries are cleaned during later reset requests.

Saved carts, quote requests, orders, supplied contact details and uploaded files support your requested transactions. These are separate from optional browser measurement. The current implementation does not automatically expire all business records. Contact Duncan Made to request help with your information; this notice does not promise an automatic deletion workflow.

Hosting and services

Railway hosts the website and database. Hosting and network services receive information needed to handle requests, such as IP addresses and request details, independently of optional measurement. We have not verified every provider log retention period. Resend processes email delivery; Stripe handles payment checkout. Information you submit for a quote, order or sign-in goes to the services needed to complete that request.

Contact

For privacy questions or requests, email duncanmadellc@gmail.com.