Privacy policy

Users’ personal data is processed by the administration of the GODLESS MARKET shop (the “administration”). Requests on any data processing matter are accepted through the support service in the shop’s Telegram bot: t.me/Godless_market_bot?start=support or by email at godless.market.com@gmail.com.

The policy covers the GODLESS MARKET website, the shop’s Telegram Mini App and the shop’s Telegram bot - one system with a shared account database.

By using the service, the user agrees to this policy. A user who does not agree with it should stop using the service.

The service does not ask the user for passport details, scans of documents, a phone number or payment details. Images are only ever sent by the user themselves and of their own choice - screenshots for a warranty claim or attachments in a support conversation. Everything that is processed is listed below by name.

When registering with email:

• the email address;
• the password - only as an irreversible hash (scrypt). The shop does not store and cannot recover the original password;
• timestamps: address confirmation, password change, last sign-in.

Until the address is confirmed, the registration request is kept separately from accounts and is deleted if the address is not confirmed.

When signing in with Telegram, the shop receives from Telegram and stores:

• the numeric account identifier (Telegram id);
• the username, if one is set;
• the first and last name as given in the profile;
• a link to the profile photo, if it is public.

The user’s phone number, contact list and messages are neither passed to the shop nor requested.

Account settings: the chosen interface language (Russian or English) and the currency amounts are shown in (US dollars or roubles), as well as the language reported by the browser or Telegram. They are needed so the website, the Mini App, the bot and emails speak to the user in one language and show amounts in the chosen currency.

Also: whether to receive messages about new products in the bot (this can be switched off in the bot), a mark that the user has blocked the bot - so it does not write to them - and delivery records of the bot’s broadcasts: who was sent a message and when.

When linking Telegram to a website account - the request to merge the accounts: which accounts are merged, what the user was shown before confirming, their decision and the time.

For purchases and top-ups:

• the order contents - product, price, promo code and discount applied, status, date;
• the access details delivered and assigned to the order, and its warranty period;
• the payment details returned by the payment service: the method and network chosen, the invoice identifier, the amount, a mark for payment from the internal balance;
• the current balance and its transaction history - credits, charges and their reason;
• the currency in which the user saw the amount of an operation and the rate at the time of the operation with its source - so the history shows amounts as they were on the day;
• top-up calculations: the amount entered and its currency, the rate, its source and time, the calculated amount in US dollars and how long the calculation is valid;
• notifications sent to the user, whether they were read, and whether the user removed them from the feed: a removed notification is no longer shown in the account but stays in the shop’s records;
• places in queues for sold-out products - product, time of joining, fixed price, the choice of automatic purchase from the balance and the history of status changes.

The shop does not receive or store bank card details - payment is accepted only through payment providers.

For support requests and warranty claims:

• support requests - the ticket number, its status, the order it was opened from, the text of the user’s messages and the operators’ replies, the time and whether a reply was delivered. Photos and files the user sends to the bot are forwarded to the operators through Telegram: the shop keeps only a mark that there was an attachment, the file itself stays with Telegram;
• warranty claims - the order, the reason, the description of the problem, the screenshots the user attached (JPEG, PNG or WebP images of up to 2 MB each), the review history and the decision;
• operators’ messages about an order - kept in the account as notifications.

Technical data related to sign-in security:

• in the table of active sessions - the IP address and the browser’s User-Agent string, the session creation time and the time of the last request;
• a sign-in attempt counter: the action (sign-in, registration, password reset), the rate-limit key, a success mark and the time. It is needed to limit password guessing;
• the IP address from which an email confirmation, a password reset or a Telegram sign-in code was requested;
• web server logs - the IP address, the page address requested, the User-Agent string, the time and the response code;
• application logs - internal identifiers of accounts, orders and payments, error descriptions and the answers of payment services and Telegram. Passwords, tokens and the text of conversations are not written to them, and email addresses only partly masked.

What is not collected. The shop keeps no advertising profiles, uses no web analytics counters or advertising pixels, does not track the user’s behaviour on other websites and does not buy data about users from third parties.

Data is processed only in order to:

• create an account and provide sign-in to it - email and password or Telegram id;
• accept payment, deliver the product and keep the delivered data available in the account;
• fulfil warranty obligations and handle requests;
• keep the internal balance;
• show the interface and amounts in the chosen language and currency;
• notify about order events - delivery, refund, credit;
• run the queue for sold-out products and report its progress;
• tell the user about new products in the bot - until they switch such messages off;
• protect accounts from password guessing and abuse;
• comply with the law applicable to the administration.

The ground for processing is the performance of the contract with the user (the public offer), and, for data not required to perform the contract, the user’s consent, given by registering in the shop.

No decisions with legal effects are made solely on the basis of automated processing. A payment is confirmed automatically on the payment service’s signal - that performs a contract already concluded and is not such a decision; the product is handed to the buyer by an operator.

The shop does not sell or share data with third parties for marketing purposes. Data is shared only with the services the shop cannot work without:

• Heleket - payment acceptance. The amount and the invoice identifier are passed; the service itself receives the payer’s transaction data.
• Crypto Bot - payment acceptance inside Telegram. The amount and the invoice identifier are passed.
• xRocket - payment acceptance inside Telegram. The amount, the invoice identifier and a service label of the order or top-up are passed. The service reports the payment status to the shop and, if the payer uses xRocket, their Telegram id and username - the shop keeps this notification with the payment.
• Resend - delivery of service emails. The recipient’s address and the email text (registration confirmation, password reset) are passed.
• Telegram - delivery of notifications to the bot, sign-in with Telegram and support conversations: the user’s messages and attachments are forwarded to the shop’s operators, and the operators’ replies to the user. Telegram ids and message text are passed.
• The hosting provider - the website, the bot and the shop’s database run on its rented servers. Database backups are kept on the same server; encrypted copies of them may be kept by a cloud storage provider.

Each of these services processes data under its own policy. The shop passes them the minimum needed to perform their function.

To convert amounts into roubles, the shop’s server obtains exchange rates from public sources: the Heleket and Crypto Bot payment services, CoinGecko, the official rate of the Bank of Russia (through the cbr-xml-daily.ru service) and ExchangeRate-API. These requests are made by the shop’s server, and no user data is passed in them.

Data may be disclosed to competent authorities where the law applicable to the operator expressly requires it.

The services listed - Telegram, the payment services, the email service and the hosting provider - run on their own infrastructure, including outside the user’s country. By using the service, the user accepts that passing data to these services is necessary for it to work.

The shop uses three cookies, all of them technical: a session cookie - without it signing in to the website does not work - and two settings cookies that remember the chosen language and currency. There are no advertising or analytics cookies, so there is no consent banner either.

Session cookie - stores a random session token by which the shop recognises the signed-in user. The HttpOnly flag hides it from scripts on the page, SameSite=Lax from being sent by other websites, and in production Secure is added. It lives for 30 days; on sign-out the cookie is deleted and the session is revoked on the server.

Settings cookies - gm_lang (language: ru or en) and gm_currency (display currency: USD or RUB). They contain no identifiers and are needed so a page opens straight away in the chosen language and currency, including before signing in. They live for one year.

Cookies can be deleted or blocked in the browser. Without the session cookie, signing in to the website is impossible; without the settings cookies, the language and currency are determined afresh on each visit.

In the Telegram Mini App the user is recognised by the signed launch data Telegram itself provides, not by the session cookie.

Browser storage. The shop does not write the buyer’s data to localStorage or sessionStorage. The Telegram script running in the Mini App may store launch parameters in session storage - Telegram does that itself. The admin panel keeps a draft of the shop settings and drafts of product cards in the administrator’s browser localStorage.

Account data - email, Telegram id, name, balance, chosen language and currency - is kept while the account exists. When an account is deleted, the records linked to it - sessions, balance transactions, notifications, queue places, support requests, warranty claims and the images attached to them - are deleted with it.

Orders, balance transactions, support requests and warranty claims are kept while the account exists: they are needed to honour the warranty, handle claims and confirm completed transactions. Service records about authentication live much shorter - sessions and sign-in links are deleted automatically a few days after they expire.

Technical data is deleted automatically:

• session records - 7 days after the session expires;
• email confirmation and password reset tokens - 7 days after they expire;
• unconfirmed registration requests and Telegram sign-in codes - after one day;
• sign-in attempt records - after two days;
• processed payment notifications from payment services - after 30 days;
• unused and cancelled top-up calculations - after 30 days;
• delivery records of the bot’s broadcasts - 60 days after the broadcast finishes;
• web server and application logs - overwritten as they fill up: their size on the server is limited;
• database backups on the server - after 14 days.

The user has the right to:

• obtain information about which of their data is processed;
• demand that inaccurate data be corrected;
• withdraw consent to processing and demand deletion of data - except information the administration must keep by law or that is needed to perform contracts already concluded;
• demand that processing stop and appeal against the administration’s actions to a competent authority.

Some rights are exercised without a request: the email, the Telegram link, order history and the balance are visible and can be changed in the profile, the language and the currency in the site header, and signing out revokes the session.

For other requests - support in Telegram: t.me/Godless_market_bot?start=support or by email at godless.market.com@gmail.com. Such requests are not accepted any other way; a reply is given within a reasonable time of receipt.

Withdrawing consent to processing the data needed to sign in to the account is equivalent to a request to delete the account: without an email or Telegram id it cannot be signed in to.

Passwords are stored as a hash computed with scrypt and an individual salt. Session tokens are stored only as a SHA-256 hash - a leaked database does not allow signing in with someone else’s session.

A password change revokes all of the user’s active sessions. The number of sign-in, registration and password reset attempts is limited.

Only the administration and persons it has authorised to maintain the shop have access to the database. Measures taken: passwords are stored only as an irreversible hash, the website and the Mini App exchange data over HTTPS, sessions have a limited lifetime and are revoked on sign-out, the admin panel is available only to accounts with a separate role, and service records about authentication are deleted automatically.

There is no absolute protection of data transmitted over the internet, and the administration does not guarantee it. The measures above reduce the risk but do not eliminate it entirely.

No system is absolutely secure. The user should use a unique password and not give anyone else access to the account.

The shop is not intended for persons who, because of their age, may not enter into such transactions on their own, and does not knowingly collect their data. If the administration learns that an account was created by a child without the consent of a legal representative, the data will be deleted.

The administration may change the policy. The current version is always published on this page, with the date of the last update at its top.

The policy is an integral part of the user agreement and the public offer.