Privacy policy
This store has no database. That is an architectural decision rather than a privacy claim, but it decides most of what follows: there is no customer table here, no order history here, and nothing here to leak. What the store needs to know, it asks the payment provider each time and then forgets.
This page describes what actually happens in the code. Where it names a company, that company has its own privacy policy governing what it does with the data.
What we hold ourselves
An account, if you make one. It is your email address, whether you have confirmed it, and a one-way hash of your password — never the password itself, and there is no way to read one back out of a hash. Alongside it we keep a record of each browser you are signed in on, so that you can end a session from another device, and a short-lived record of any password reset you have asked for.
We also keep a set of empty marker files recording that a delivery email for an order was sent. They contain no personal data — only an order identifier — and exist so a retried webhook does not email you the same licence key twice.
We hold no record of what you have bought. Orders, invoices and entitlements live with the payment provider and are read back on demand when you open your account.
Cookies
We set six on this site, and two more on the separate site where you sign in. All six are functional. There is no advertising cookie — not before you are asked, not after, and not if you accept.
There is one third-party tag: Google Analytics, which tells us which pages people read and where they arrived from. Until you answer the banner it stores nothing on your device: consent for storage is declared denied before the tag is allowed to measure anything, and it stays denied if you refuse. If you accept, it stores the two cookies in the second table below and nothing else.
Refusing is a real option and it costs you nothing. The tag still counts the page, without a name for your browser — so we learn that a page was read and not that you read it. That is the whole difference the button makes.
Accepting never turns on advertising. The code can only ask for one permission, analytics_storage, and the list of permissions it is allowed to ask for is a fixed list of one in src/lib/analytics/consent.ts. Adding a second one would turn a test red before it could ship, and that test exists because this paragraph is a promise rather than an intention.
You can check all of this the same way as before: open your browser's cookie list on any page of this site. Before you answer, every name in it will be one of the six below — except hullara_consent, which is your answer and does not exist until you have given one. NEXT_LOCALE is there from the first page you open, because choosing a language is not a question we have to ask.
On this site:
| Cookie | What is in it | How long |
|---|---|---|
hullara_checkout_queue | The themes still to be paid for when a cart is settled one payment at a time. Theme names and tiers only. | 2 hours |
hullara_src | The name of the campaign whose link brought you here — a label we chose, like launch-email, and nothing else. It is set only when a link carries one, it is HttpOnly so no script on the page can read it, and it exists so we can tell which of our own emails and comparison pages are worth writing. It never leaves our servers, it is not sent to the payment provider, and it identifies a campaign rather than a person: the value is checked against a short list of allowed characters and thrown away whole if it does not match, so nothing that looks like an address or an identifier can be kept in it. | 30 days |
hullara_visit | A random string with no meaning — no name, no address, nothing about you or your device — that lets our own server tell one browser from another for half an hour. It exists for one reason: when two people press Buy on the same theme within the same two minutes, it is how we know those are two purchases and not one person clicking twice, so the second person is not turned away. It is HttpOnly, it is not sent to the payment provider or to anyone else, and it is not refreshed while you browse — thirty minutes after it is issued it is gone, and nothing connects the next one to it. | 30 minutes |
hullara_ctx | Where this visit came from: the name of the site that linked here (www.google.com, old.reddit.com), the first page you opened, and the utm_medium on the link if it carried one. The host only — never the address of the page you came from, because that address belongs to somebody else's site and can carry their own user's search terms. Its value is written once per visit and never rewritten. The expiry is moved forward each time you come back, so the thirty days run from your last visit rather than your first — if you read this site once a month it does not lapse on its own. Clearing your cookies removes it, and so does thirty days away. It is HttpOnly so no script on the page can read it, and it exists so we can tell which of our own pages are worth writing. | 30 days from your last visit |
hullara_consent | Your answer to the analytics banner, so it is asked once rather than on every page. The value is the word granted or the word denied and nothing else — anything else that appears in it is thrown away whole and read as "not answered yet". It is the one cookie on this list a script on the page can read, because the banner has to know whether to appear. | 6 months, then we ask again |
NEXT_LOCALE | Which of the four languages you are reading in, so a link you follow stays in it. The value is en, vi, es or pt and nothing else. It is set by the framework that renders this site rather than by us, which is why it is the one name here that does not begin with hullara_. | 1 year |
Only if you accept, Google Analytics stores these two and nothing else. Refusing, or simply not answering, means neither is ever written:
| Cookie | What is in it | How long |
|---|---|---|
_ga | A random identifier for your browser, set by Google Analytics, so that two visits a week apart can be counted as one returning reader rather than two strangers. It contains no name and no address. | 2 years |
_ga_* | The same thing scoped to this site's measurement property — the name ends in the property's own identifier, so the exact spelling depends on which property is configured. It holds the timing of your current visit. | 2 years |
Your account is on a separate site, app.hullara.com, and so is everything that signs you in — this site holds no session at all. Two cookies are set there and nowhere else:
| Cookie | What is in it | How long |
|---|---|---|
hullara_app_session | A random token that identifies your signed-in session. It carries no information about you — the address it belongs to is held on our server, which stores only a one-way hash of the token itself. Marked HttpOnly, so scripts cannot read it. | As long as the session lasts, at most 30 days, or until you sign out |
hullara_app_reset | The address a password reset is in progress for, so you do not have to type it twice and it does not have to travel in the page address. | 30 minutes |
Signing out clears the session cookie on your device and ends the session on our server, so a copy of the cookie taken beforehand stops working too.
What your browser keeps locally
These never leave your device and are not readable by us:
hullara-cart— what is in your cart, as theme names and tiers. Prices are always re-read on our side, never taken from here.hullara-theme— whether you chose light or dark. Absent unless you use the toggle.
Who processes your data
The payment provider (Polar) is the merchant of record. Your name, email, billing address and card details go to them at checkout. We never see or handle a card number. They hold your order history; we read it back on demand when you open your account, and keep no copy.
Brevo delivers the address-confirmation link, the six-digit password-reset code, and the delivery email that follows a purchase. It sees the recipient address and the message. It also holds the release-notification list described below.
The release-notification list
A theme that is not on sale yet has a form on its page reading "tell me when it ships". If you use it, three things are stored, on a contact list held at Brevo:
| What | Why |
|---|---|
| Your email address | To send the one message |
| Which theme you asked about | So you are told about that theme and not the other three |
| Which language you were reading | So the message is in it |
The lawful basis is your consent, given by submitting the form. It is used for one announcement about that theme and for nothing else: no newsletter, no offers, no second list. To be removed, use the unsubscribe link on the message or write to [email protected] and it is deleted.
If no list is configured, the form is not shown at all — the page gives you an address to write to instead. There is no state in which your address is accepted and then discarded.
Cloudflare R2 stores the theme files. The bucket is private; files are only ever served through this site, after a licence check.
Our hosting provider runs the site and receives ordinary web request data, including IP addresses, in the course of serving it.
Server logs
Order events and errors are written to the server log. These entries include order identifiers, customer identifiers at the payment provider, and — for a completed order — the email address on it. Licence keys are logged only as the last eight characters, and never in full.
Logs are operational: they exist to tell us why something failed. They are not analysed, not joined to anything, and not used to build a profile.
What is written into your download
Every theme file you download is stamped, in a LICENCE.txt file at its root and a comment at the top of layout/theme.liquid, with:
- your customer id at the payment provider,
- the last eight characters of your licence key,
- the theme version and the time of the download.
The stamp itself is inert: it is a comment and a text file, it does not run and it contacts nobody. It exists so that a copy found circulating can be traced back to the account that downloaded it.
What the installed theme sends us, and what that means for your own shoppers
This section is about a data flow you become responsible for when you install the theme on a store, because it happens in your shoppers' browsers rather than on this website. It is set out here so you can describe it in your own privacy notice if you need to.
Once per visit at most — after the page has finished painting, never before — the theme asks our licence service whether your licence is current. Where a valid answer is already cached, it does not ask again for 72 hours, so in practice this is one request per shopper every few days.
| What reaches us | Why |
|---|---|
Your .myshopify.com domain | So the answer is bound to your shop and cannot be replayed on another |
| The edition the theme was built as | So the answer is about the right product |
| The IP address and user agent of the request, as with any web request | Unavoidable in serving an HTTP request; used to serve it and rate-limit it |
No shopper identity is sent. No cookie, no customer id, no cart, no page URL, no order — nothing that identifies the person browsing, and nothing about what they are looking at. We cannot tell your shoppers apart, and we do not try to.
The theme writes one entry, hullara:license, into that browser's localStorage: the signed answer and the time it was accepted. It is what makes the 72-hour cache work. It is not an identifier, it is not read by anything else, and clearing site data removes it.
Every failure resolves to fully licensed — see how licensing works for exactly when a licence notice can appear on a storefront and when it cannot.
Rate limiting
To stop this site being used to send unwanted mail, to stop passwords being guessed, and to stop the download endpoint being run in a loop, we count recent requests. Counts per IP address are held in server memory, never written to disk, and lost whenever the server restarts. Counts per email address are stored, because a limit that a restart erases is not a limit — they record the address, a number and a time, are not joined to anything, and are swept away once the window they cover has passed.
Your rights
Your purchase history is the payment provider's rather than ours, so requests about it are faster made to them. Everything to do with your account is ours. Write to us at the address below either way and we will point you to the right place, or make the request on your behalf.
- Access — your orders, invoices and licence keys are visible at any time in your account.
- Deletion of your account — ask us, and we delete the address, the password hash and every session with it. This does not delete your purchases, which are held by the payment provider.
- Deletion of your purchase record — ask the payment provider to delete your customer record. Deleting it removes your access to downloads, since ownership is only ever read from them.
- Signing out everywhere — signing out ends the session on our server, not only in the browser you are using.
Children
This store sells developer tooling to businesses and is not directed at children.
Changes
Material changes to this page will be announced on it with a revision date.
Who to write to
Hullara decides what this site does with your data, and is who to write to about any of the rights above: [email protected]. We answer these ourselves.
Two things belong to someone else, and writing to us about them will be slower than going direct:
- Your payment data — name, billing address, card details — is held by Polar, who are the seller of record and decide what happens to it. Their privacy notice is at polar.sh, and we never see a card number.
- Email delivery. Confirmation links, password-reset codes and download emails are sent through Brevo, who see your address and the message in order to deliver it. The release-notification list is held there too.