Privacy

Only what is needed to run the shop:

• Your bag — held against a random token in a cookie, not against you.
• Your account, if you create one: name, email, a hashed password, and any address you save.
• Orders, including a snapshot of what was bought and where it was sent.
• Newsletter subscriptions, if you opt in.
• Messages you send through the contact form.

Passwords are stored as bcrypt hashes and are never recoverable in plain text. Session cookies contain a random token; only a SHA-256 hash of it is kept in the database.

Two cookies, both strictly necessary and both HTTP-only:

• bb_cart — keeps your bag between visits. Expires after 60 days.
• bb_session — keeps you signed in. Expires after 30 days.

There are no advertising or cross-site tracking cookies, and none at all for counting visits — see Visitor numbers below.

The application emits commerce events (product viewed, added to bag, and so on) to a local event layer. No analytics provider is connected, so nothing leaves your browser.

We count how many people visit and which pages they open. That counting is done by this site itself — no analytics company is involved, and nothing about your visit is sent anywhere else.

For each page opened we store the path, the time, whether the device is a phone, tablet or computer, and the website you arrived from if there was one — its name only, never the full address, so a search you made or a private page you followed a link from cannot appear here.

We do not store your IP address, your browser details or any cookie for this. To count you once rather than ten times in a day, your address and browser are combined with a secret that changes every day and turned into a one-way code. The code cannot be turned back into your address, and tomorrow the same visit produces a different code — so the figures cannot be used to follow anybody from one day to the next, or to work out who they are.

Because no cookie is used and nothing identifying is kept, there is nothing here to consent to or withdraw. If that ever changes, this page will say so before it does.

Order data is shared only with the courier delivering your parcel — which for international orders means a customs declaration — and with a payment provider once one is connected.

Nothing is sold, and nothing is shared with advertisers.

Write to mybelberry@gmail.com to ask for a copy of what we hold, to correct it, or to have it deleted. We will respond within 30 days. Ghana's Data Protection Act, 2012 (Act 843) gives you these rights, and the Data Protection Commission is the regulator.

Deleting your account removes your profile and sessions. Orders are retained where we are required to keep them for tax and accounting purposes.