Security
Security and privacy at TPD
No marketing talk, just what the system actually does: what we store, for how long, who can read it and what you can delete yourself. Every line here matches the code; if we change a rule, we change this page.
Last updated: 15 October 2026
Contents
01 The rule we build by
We store as little as possible, for as short a time as possible. We assume the server could be seized or hacked one day. Anything that would hurt you in that case must either not exist on the server or be unreadable there. That is why addresses are sealed with a key that never touches the server. It is also why there is no password to steal and why you can order without an account.
02 Login and sessions
There is no password. You request a one-time link by email and use it once; it expires after 15 minutes and is stored on the server only as a hash. Two-factor authentication is optional in your account settings.
| What | How long | Who can read it |
|---|---|---|
| Email address of your account | Until you delete the account | Us, for order mails |
| Login link (one-time token) | 15 minutes, deleted one hour after expiry | Only hashed on the server |
| Session cookie | 30 days, extended on every visit | Your browser and our server |
| IP address and browser of a login | 7 days, then removed from the session | Only for the referral-code fraud check |
03 Cookies, tracking, third-party code
- No analytics scripts, no advertising pixels, no fingerprinting, no profiling on the site. No cookie banner because nothing here needs consent.
- Three cookies only: the session, an anonymous cart before login and a 24-hour referral-code cookie if you arrive via a link with a code. Nothing from Google, not even a click ID.
- Third-party code loads in exactly one place: the Trustpilot box on the reviews page. Nowhere else.
- Fonts, scripts and images are served by us, not by Google or a CDN of a third party.
04 Payments
- Card data never touches our systems.
- Crypto: you send to a wallet address and enter the transaction ID; we store only the ID and confirm automatically on the blockchain.
- PayRam (PayPal, Revolut, crypto): the payment runs at the provider, including its one-time verification. We receive the confirmation and the order reference, nothing else.
- Bank transfer: your bank statement and ours show the order number and the amount. Your name is on the transfer, which is why guest and anonymous orders cannot use it.
- Cash on delivery: you pay the courier; name and signature happen at the door. Not available for guest and anonymous orders.
05 Shipping address: sealed, then deleted
Your shipping address is the most sensitive thing we hold, so it has a clock. As soon as the parcel is shipped it is sealed: encrypted with a public key whose private half is kept safe and has never been on the server. From then on the server cannot read it. Neither can anyone who takes the server. 90 days after delivery the clear text and the tracking number are deleted. The sealed copy stays in case the tax office asks. Sealing waits only while part of the order is still to ship or a refund request is open. A reshipment or a return after sealing needs the address again, from you or by opening the sealed copy with the private key; cancelled or refunded orders that never shipped are sealed 14 days after the last change.
| What | How long | Who can read it |
|---|---|---|
| Items, prices, payment method, payment date, status | Kept (accounting records) | Us |
| Shipping address in clear text | Until the parcel is shipped | Us and the carrier |
| Sealed address (encrypted copy) | Kept, readable only with a key that is not on the server | Only with the private key, which is kept safe and is not on the server |
| Tracking number and events | Deleted 90 days after delivery | Us, you, the carrier |
| Your note from checkout and our shipping note to you | Deleted together with the address | Us |
| Bank details for a refund | Until the refund is transferred, then deleted | Us |
| Hashes of IP and browser at the time of ordering | 30 days | Only for the referral-code fraud check |
You do not have to wait: once the parcel is delivered, the order page has a button that seals and deletes the address immediately. The order page always shows the exact dates for your order.
06 Ordering without an account
- Guest with email: no account, you only give an email and the address. The order mails contain a link that opens your order.
- Anonymous: no email at all. You receive an order number and an access code once; we store the code only as a hash. No mails, ever. Lose the code and nobody can open the order, not even we; keep both safe until delivery, we are not liable for a lost code.
- Both only with PayRam or crypto, so no name appears on a transfer or at the door.
07 Parcel and sender
- Packstation and parcel shop are possible and, for anonymous orders, the safest choice.
- The carrier receives name and address for the label. Your email goes to DHL only if you tick the box in checkout; it is off by default. Anonymous orders never pass an email on.
- You can choose vials without labels; which colour dot marks which vial is only in your order details and the shipping mail, never on a note in the parcel.
08 Servers and infrastructure
- HTTPS everywhere, strict security headers, rate limits on every sensitive endpoint, admin access only with two-factor authentication.
- Server logs contain no IP addresses, no browser identifiers and no query strings, only method, path, status and duration of a request. They are overwritten after about a week. The web server keeps no access log at all.
- Database backups are encrypted: every daily backup is encrypted on the server with a public key before it is stored. The private key is kept safe and is never on the server. Anyone copying the server gets nothing but unreadable files from the backups as well. Backups are deleted after seven days.
- Mails are sent through a mail provider (see the privacy policy for all processors).
- Few dependencies, little third-party code: every additional service is an additional risk, so we add as few as possible.
09 What you can do yourself
- Delete the address right after delivery: button on the order page.
- Order as a guest or anonymously if you do not want an account.
- Use a Packstation or parcel shop instead of your home address.
- Pay with crypto or PayRam if your name should not appear on a transfer.
- Take product names out of our emails: switch under Account, Security. Guest orders never get product names in emails.
- Delete your account yourself under Account, Security: the email is replaced by a placeholder, sessions and cart are removed. The addresses of completed orders are sealed and cleared. Items and amounts stay for accounting.
10 Where our reach ends
- Support runs over Discord, Telegram and WhatsApp. What you write there is stored by those services under their rules; do not post addresses or order details you would not want there.
- The carrier, your bank and your payment provider keep their own records; we cannot delete those.
- The sealed copy of an address is protected with the highest level of security: RSA-4096 with AES-256, the private key kept safe and never on the server. It cannot be cracked with today's technology. It is opened only when truly necessary.
- No online system is absolutely secure. If something changes about these rules, this page changes with it.