Privacy

What we store about you, why, and for how long. In plain words — if a sentence here needs a lawyer to decode, it is our failure, not yours.

Where you were when you bought

When you buy, we record up to three things about your location: the country you choose at checkout, the country that issued the card you paid with (Stripe tells us this — we never see the card number itself), and the IP address the order came from.

We record it because the tax on a digital purchase is decided by where the buyer is, and we are required to hold two pieces of evidence for that which do not contradict each other. That is the whole purpose. None of it is used to build a profile of you, to advertise, or to guess anything else about you.

Today we do not translate that IP address into a country — the other two signals already give us the two we need. We keep it in case a tax authority ever asks us to show a third, which is the only thing it would be used for.

The two-letter country codes are part of the accounting record behind your receipt, so we keep them for 10 years. The IP address itself is different: it is far more identifying than a country code and tells us nothing extra once the country is recorded, so we erase it after 12 months.

The erasure is done by a scheduled job, not by hand. It overwrites the address and records the date it did so — so if you ever ask, we can tell you the difference between “we destroyed it on this date” and “we never had one”.

If the three signals disagree with each other, that is flagged for a person to look at. It usually means nothing — people travel, and cards follow them — but it is also how card fraud looks, so we would rather check.

The payment page

Two things on this site contact someone other than us, and they are different in kind. The checkout page always does, whatever you have chosen: the card fields are supplied directly by Stripe, our payment processor, so your card number reaches them and never us. Separately, every page — the checkout page included — contacts Google if, and only if, you agreed to analytics. If you have not, or you said no, nothing of Google’s is loaded on any page at all.

Stripe also loads hCaptcha, a bot-detection service, to protect the payment form from automated card testing. We did not choose to add it, and we have not found a way to switch it off while still taking cards — we have not worked through every configuration of Stripe’s card fields looking for one, so treat that as our conclusion rather than a measurement. Either way it is there, so we are telling you.

On some visits — not all — Stripe additionally loads HUMAN Security, a second bot-detection service; in your browser’s own list of connections it appears as px-cloud.net, a hostname left over from its PerimeterX days. Which visits get it is decided by Stripe’s own fraud check, inside their code: we cannot see that decision and we cannot influence it. We have not found a way to switch the service off while still taking cards, and we have not tested every configuration of Stripe’s card fields looking for one — so that is our conclusion, not a measurement. We name it here because we found it on our own payment page and traced it back to Stripe, not because anybody told us it was there.

Stripe’s fraud tooling carries more than one service of this kind and chooses between them, so we are not going to tell you this list can never grow. What we can tell you is how a new one would reach you: it would first turn red the check we run against this page, and the name would go on this page in the same change that lets the request through — never in a later one.

What reaches them is your IP address and basic information about your browser. None of it is used to advertise to you, and we ask none of them anything about you.

Their own privacy policies, if you want them: Stripe, hCaptcha and HUMAN Security. Those open on the companies’ own sites. We check that all three addresses still answer as part of the routine checks we run against this site, because a dead link on a privacy page is a promise that quietly stopped being kept.

Google Analytics

If you agree to it, this site loads Google Analytics 4 through Google Tag Manager, and Google receives your IP address, the pages you open on this site, roughly when and for how long, and basic information about your device and browser.

The basis for it is your consent, and nothing else. That is why nothing is loaded before you answer, why refusing is one press, and why withdrawing works: there is no second justification underneath it that would keep the processing going after you said no.

For this measurement Google acts as our processor, under Google’s own data-processing terms. The property the data goes to is G-C7ZLDWV9DC, and we do not link it to your order record or to the email address you give us at checkout.

What Google measures for us is page views plus its enhanced measurement: scrolling, clicks on links that leave this site, interactions with forms, video plays and file downloads. We switched site search off, because it would record the words you type into our own catalogue search — and this site publishes that a search term is not something we keep.

Form-interaction measurement covers the payment page too. Google is told that a field was interacted with, never what was typed into it, and it never receives your card details, which reach Stripe directly and not us either. It does mean that after you agree, the payment page has one more recipient than the processors named above.

We refuse advertising storage and advertising personalisation in the consent signal we send Google, for everyone, always. We do not run advertising on this site and we do not export anything from this measurement to an advertising platform.

Every data-sharing option in our Google Analytics account is switched off: nothing goes to other Google products and services, nothing is contributed to Google’s models or benchmarks, and neither Google’s technical support nor its account specialists have access to it.

The terms we accepted are Google’s European ones, the version in which the clause covering the processing of personal data is mandatory rather than optional. That is not the default a Google account starts on, and it is the reason this paragraph can say what it says.

Google is a United States company and processes this data on infrastructure it operates internationally. Transfers out of the European Economic Area happen under the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework, to which Google LLC is certified. That is a materially different arrangement from our own count, which never leaves our own server in Europe.

How long Google keeps it is set in the Google Analytics property, not by us, and Google’s own retention controls apply. Our own visit records are separate, are kept for 24 months and are described further down this page.

You can withdraw at any time on the cookie page, and the link to it is in the footer of every page here. Withdrawing stops the loading, not merely the reporting.

Your order and your eSIM

The email address you give at checkout; what you bought and what you paid; the device-compatibility answer you were shown before paying; and, for each eSIM we issue you, its ICCID and activation code — the QR.

The email is how we deliver your eSIM and how you get back into your order later; there is no password on this site. The ICCID and activation code are the eSIM — without them we cannot re-send it or help when it will not install. The device answer is kept so that, if there is ever a disagreement, it is clear what you were told before you paid.

Order records, including the ICCID and activation code, are kept for 10 years, because they are the accounting record behind a receipt and we are required to hold them.

We never see or hold your card number — payment is handled by Stripe. We do not store your phone’s IMEI or EID, we do not sell your data, and we do not hand anything about your order to advertisers. One thing we do share, and only if you agreed to it, is the visit measurement described above: Google receives that as our processor, with every data-sharing option in our account switched off and advertising storage refused. Your email address, what you bought and your eSIM are not part of it and are not joined to it.

Our own support staff can read it, in an admin area that records who looked at what. Our network partner necessarily receives the request to issue your eSIM, but not your name and not your email — only an anonymous reference.

Sign-in links

When you ask for a link to reopen your order, we store your email address, a one-way hash of the link’s token — never the link itself — when it expires, and the IP address the request came from.

The hash lets us check your link without our database ever containing a working key to your orders. The IP address is kept only so we can investigate if somebody floods an inbox with sign-in requests.

Kept for 30 days, then deleted by a scheduled job — the same kind of job, on the same schedule, as the erasures described above.

We do not store your browser, your device, or any identifier that would let us recognise you somewhere else.

How you found us

When you first arrive, we record which website or search engine sent you, which of our pages you landed on, and any campaign tag in the link you followed. While you are here we also count how many pages were opened and whether one of them was a plan page — a page with a price on it — which is how we tell an arrival that looked at something from one that did not. That record is kept whether or not you buy anything — it is how we count visits at all — and if you do buy, a copy of it is stored on the order as well.

We keep the name of the site — “google.com”, “chatgpt.com” — and nothing else from it. Not the address of the page, and not what you typed into a search box to get here. If you searched for us, we do not know what you searched for.

It is the only way to tell which of our pages actually help people find what they came for. That is the whole use. It is not linked to anything you do elsewhere, it is not sold, and it is not shared with an advertiser.

This particular record is made by our own server: it sets no tracking cookie of its own and needs no script in your browser. While you are on the site, the arrival is held in the ordinary session your browser already keeps for security (“fivebars-session”); the count itself is a row on our own servers, and the session cookie is only what tells one visit apart from the next. It holds no IP address and no device fingerprint. It is made whether or not you agreed to Google Analytics, and it is never sent to Google.

Both the visit record and the copy on an order are kept for 24 months, and then a scheduled job erases them. That is deliberately shorter than the 10 years we hold the accounting record behind your receipt: we are required to keep that, and there is no such reason to remember how you arrived. The order stays; how you found us is deleted from it, and the visit row is deleted outright.

The visit count holds no IP addresses. The only place this site stores one is the tax evidence behind an order, described above, with its own shorter deadline — we did not make a second copy for statistics, because counting visits does not need one.