Personal Data Policy

Version of 2 November 2026. This is a translation; the Russian version prevails.

1. General

1.1. This Policy sets out how personal data of users of pochtikupil.ru (the “Site”) is processed and protected under Russian Federal Law No. 152-FZ “On Personal Data”.

1.2. The data controller (operator) is Спицын Алексей Юрьевич, an individual (the “Operator”). Contact for personal data matters: alexey6522@mail.ru.

1.3. The Site is a demo (entertainment) online store. Nothing is sold, no payment is taken and nothing is shipped; orders, delivery, points and promo codes are simulated. The Site never asks for or processes payment details.

2. What data is processed

2.1. The Site collects minimal data: signing up needs only a username of your choice and a password. No name, phone number, email or ID details are requested — the Site has no fields for them.

2.2. Without an account (guest), cart, orders, profile and addresses stay in your browser only and are not sent to the Operator — except support chat messages once you ask for a human agent. Delivery addresses (for the simulated courier on the map) and chats with the virtual assistant stay in your browser even with an account and are never sent to the server.

2.3. For registered users the Operator processes:

  1. Account: username; password — stored only as an irreversible salted hash (PBKDF2-SHA256).
  2. Orders (simulated): contents and total, city, delivery method and chosen pickup point (a public store address), delivery and payment options, statuses. No recipient or courier address is sent.
  3. Virtual wallet: history of virtual-ruble transactions (top-ups, payments, refunds), terms and schedules of virtual installments and loans, overdue amounts and penalties. This is game data: no real money, bank cards or lenders are involved.
  4. Reviews and product questions: text, rating, date. Reviews are signed “Customer” — no username or name.
  5. Support chat (only once you ask for a human agent): messages and chat rating; for guests — a random browser identifier not linked to your identity. We don’t ask your name and ask you not to share personal details in the chat.
  6. Technical data: session identifier (cookie pk_sid); app data in browser storage (localStorage); IP address — used only in server memory to prevent password guessing and overload and never written to the database; on a server failure the IP address may appear in the technical error log.
  7. Favourites, comparison list, selected city, achievements and read marks — to sync across your devices.

2.4. No special categories, biometric or payment data are processed. Please don’t share passport or card details in chats, reviews or comments.

3. Purposes

Account sign-up and sign-in; syncing cart, orders and settings across your devices; running the demo store features; answering support chats and publishing reviews and answers; protecting the Site from abuse and overload.

4. Legal basis

Performance of the Terms of Use you are a party to (Art. 6(1)(5) of 152-FZ): the data in section 2 is needed for the account, orders, wallet, reviews and chat to work. No personal data is made public: reviews are published without a name or username.

5. Processing

Collection, recording, organisation, accumulation, storage, updating, retrieval, use, blocking, deletion and destruction — automated, using databases located in the Russian Federation.

6. Sharing

6.1. Personal data is not sold or shared with third parties except where required by Russian law. 6.2. Data is stored on a server of a hosting provider in the Russian Federation. 6.3. Address suggestions, routes and map tiles are provided through the Operator’s server using open OpenStreetMap services (Photon, OSRM, map tiles); they receive only anonymous requests — street text with the city name or route coordinates — without your IP address or identifiers. No cross-border transfer of personal data takes place. 6.4. To show exchange rates, your browser contacts www.cbr-xml-daily.ru (Russia), which sees your IP address only. 6.5. Share buttons open social networks only when you click them.

7. Retention and deletion

Account data is kept until you delete the account. “My data” → “Delete account” in your account removes the account, profile, orders, wallet, reviews, questions and chats immediately; copies in backups are destroyed when backups expire (no more than 30 days). Guest chats are kept for no more than 1 year after the last message. On a written request (stating your username) account data is destroyed within 30 days.

8. Your rights

You may get information about and a copy of your data (“My data” → “Download my data” or on request), have it corrected, blocked or destroyed, and complain to Roskomnadzor or a court. Requests: alexey6522@mail.ru; reply within 10 business days.

9. Security

Salted password hashes; HTTPS; HttpOnly SameSite session cookie; restricted database access; admin panel limited to appointed administrators; rate limits, CSRF protection and regular vulnerability checks; personal data responses are not cached by the browser and are removed from the device on sign-out.

10. Cookies and browser storage

One cookie, pk_sid (sign-in session, up to 1 year or until sign-out). Other app data lives in localStorage. No analytics or advertising trackers.

11. Changes

The Operator may update this Policy; the new version applies from publication. The current version is always at pochtikupil.ru/privacy/.