Privacy policy

Emails we send through Resend are tracked. A one-pixel image loads when the message is opened, and links are rewritten so a click is registered before you are forwarded on. Against your email address we record that a message was delivered, opened, clicked, bounced or reported as spam, and when.

This applies to marketing email and to transactional email such as an order confirmation. We use it to tell whether a receipt actually arrived before a customer tells us a parcel never shipped, and to stop sending to addresses that bounce permanently.

How to switch it off

• Set your email client not to load remote images. That stops the open pixel, and it works whoever is sending to you.
• Unsubscribe from marketing email, using the link at the foot of any marketing message or your email client’s one-click unsubscribe button. Once you unsubscribe, your address goes on a suppression list and no further marketing is sent.
• Ask us to turn tracking off for your address entirely. Email support@tridentpicks.com and we will.

Unsubscribing does not stop transactional email about an order you have placed. We would be sending a parcel with no way of telling you it was on its way.

Two cookies, both first-party, and no third-party cookies at all. The analytics described in the next section deliberately set none, which is why this site has no cookie banner: there is nothing to ask you to agree to.

tp_session: your signed-in session

Set when you log in, lasts 30 days, and is marked HttpOnly so JavaScript cannot read it. It holds a signed token, not your details. This one is strictly necessary. Remove it and you are logged out.

tp_ref: affiliate referral

Set only if you arrive on a link carrying a ?ref= code, and it records that code for 90 days so the partner who sent you gets credited if you buy. The first code wins; a later link does not overwrite it. Alongside it we store a click record with the code, the page you landed on and the referring site. It is a first-party cookie, it is not shared with anyone, and it carries no authority over your account.

To opt out: visit the site without a ?ref= link, or delete the tp_ref cookie for tridentpicks.com in your browser’s site-data settings. Blocking cookies for this site removes it too, and nothing about shopping here breaks if you do. You will just have to log in again each visit.

Your cart

Your cart lives in your browser’s local storage, not in a cookie and not on our servers. We cannot see it until you go through checkout. Clearing your browser data empties it.

We use PostHog to count which pages get opened and to be told when the site throws an error. It records the address of the page, the site that sent you, your IP address, and rough details of your browser and device, and it times how long a page was on screen.

We run it in its cookieless mode, which means it stores nothing on your device: no cookie, no local storage, no session storage, nothing to clear afterwards. Instead of tagging your browser, PostHog works out a temporary identifier on its own servers by hashing details of your connection, which is enough to tell that one visit went from the shop to a product page and no further. That is the whole reason this is here: we could see that nobody was buying, and not where they were giving up.

It is switched off in three ways. Autocapture is off, so it does not log what you click or type. Session recording is off, so nothing plays back your screen. And the addresses it receives are stripped of anything private before they are sent: a password reset link, an unsubscribe link and a payment reference all reach it with the secret part removed, so what it stores is that someone opened the reset page, never which reset it was.

Your name, your email address, your account and the contents of your cart are never sent to it, and nothing it collects is joined up with your order history.

How to switch it off

Turn on Do Not Track in your browser, where your browser still offers it, and we send nothing at all. We check for it before anything is measured, rather than asking you to trust a checkbox of ours. Any tracker blocker stops it too, and nothing about shopping here breaks if you use one. If you would rather we simply deleted what has already been collected against your visits, email support@tridentpicks.com and we will ask PostHog to remove it.

• Orders and invoices: seven years, because tax law requires it. Deleting your account does not delete an order that has already been placed.
• Account records: until you ask us to delete them.
• Contact form messages: two years.
• Email delivery and open events: two years.
• Referral click records: twelve months.
• Page visit and error records: twelve months, held by PostHog rather than by us.
• Unsubscribe records: kept indefinitely. It is the only way to be certain we never email you again.

Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or tell us to stop using it for marketing. Customers in the United Kingdom, Ireland and the wider EEA have these as statutory rights under the UK GDPR and the GDPR, and customers in California have comparable rights under the CCPA, including the right not to be discriminated against for exercising them. We give everyone the same treatment rather than sorting requests by geography.

Email support@tridentpicks.com from the address we hold for you and we will answer within 30 days. If a request would mean deleting something tax law says we have to keep, we will tell you exactly what is staying and why.

If you are in the UK or the EEA and you think we have handled this badly, you can complain to your national data protection authority. We would rather you told us first.

Our site and database run on Amazon Web Services in the United States, and Stripe, Resend and PostHog are all United States companies. We ship to the United States, Canada, the United Kingdom, Australia, New Zealand, Ireland, so if you order from outside the United States your details are transferred there. Those transfers rely on the Standard Contractual Clauses in our agreements with each provider.

The site is served over TLS. Passwords are stored as salted scrypt hashes, never in plain text and never as a bare SHA-256. Session cookies are cryptographically signed and the signature is checked on every request, so a session cannot be forged or edited. Card details never reach our servers at all.

If we ever discover a breach affecting your personal data, we will tell you and the relevant regulator within 72 hours of establishing what happened.

This shop is not aimed at children and we do not knowingly collect data from anyone under 16. If a child has given us their details, email support@tridentpicks.com and we will delete the record.

If we change this policy we change the date at the top of the page. A change that affects how we use data we already hold gets an email to anyone it affects, not a quiet edit.

Trident Picks is the controller of the data described here. Write to support@tridentpicks.com with anything at all about it.