Privacy
Privacy Policy
Last updated: 18 October 2026
This policy explains what personal data Entrashop (“we”) collects when you use entrashop.com (the “Site”), why, and what you can do about it. The Site is operated by an individual developer under the name Entrashop. We do not publish a postal address. Contact: [email protected].
1. Summary
- You can browse without an account.
- If you sign in, we store your email address, your saved stores, and your recently viewed stores.
- When you click through to a store, we count the click with a temporary code. We do not store your IP address or browser string with that click.
- We use Google AdSense to show ads. Google and other advertising vendors use cookies for that, as described below.
- We do not sell your personal data.
2. What we collect and why
| Data | When | Purpose | Legal basis (where GDPR or UK GDPR applies) |
|---|---|---|---|
| Email address | You create an account | Run your account | Contract |
| Password, stored only as a hash | You create an account or change how you sign in | Check your sign-in | Contract |
| Session, stored only as a hash | You sign in | Keep you signed in | Contract |
| Saved stores | You save a store | Show your saved list | Contract |
| Recently viewed stores, signed in | You open a store page | Show them in your account | Contract |
| Recently viewed stores, not signed in | You open a store page | Kept only in your browser (es-recent) until you clear it or sign in, when it is added to your account | Contract, or your request |
| Newsletter email and status | You subscribe and confirm | Send the weekly email. This feature may be off. | Consent |
| Outbound click record | You click through to a store | Count clicks and rank stores, including Trending | Legitimate interests |
| Short-lived security counters | You try to sign in or click a store link | Limit abuse | Legitimate interests |
| Ad request data | A page loads the Google AdSense script | Show ads and measure them. Google receives this data. | Consent where required, including in the UK and EEA; otherwise legitimate interests |
Account and sign-in. You sign in with your email or username and a password. The password is stored only as a hash. The session cookie is es_session. It is set only after you sign in, is HttpOnly, and lasts about 30 days.
Outbound clicks. We record the store, time, the page you clicked from, and device type (mobile or desktop). To tell a repeat click from a new one without keeping a profile of you, we compute a one-way code from your IP address, browser string, and a random value that changes every day. That value is deleted after about 48 hours. After that, the code cannot be linked back to you. We do not store your IP address, browser string, or account id with the click. Known bots and link prefetchers are not counted. Click records are deleted after about 13 months.
Advertising. The Site loads Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on prior visits to this Site or other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on your visits to this Site and other sites. You can opt out of personalized advertising at Google Ads Settings. You can also opt out of some third-party vendors’ cookies for personalized advertising at www.aboutads.info. Google’s own description is in the Google Privacy Policy and How Google uses information from sites or apps that use its services.
Cookies and local storage we set.
| Name | Type | Purpose | Duration |
|---|---|---|---|
es_session | Cookie, HttpOnly | Keeps you signed in. Set only after sign-in. | About 30 days |
es-recent | Local storage | Stores you viewed while signed out | Until you clear it, or you sign in |
es-podium-revealed | Session storage | Plays the Trending animation once per visit | Until you close the tab |
Google may set its own advertising cookies when an ad request runs. Store websites you open from Entrashop may set their own cookies, including affiliate cookies. Their policies apply once you leave.
Logs. Cloudflare, which sits in front of the Site, and our server can see request data, including IP addresses, for security and operations. We keep those logs only for the short period needed for security and operations.
We do not collect payment information. We do not knowingly collect special-category data.
3. Links to stores
Entrashop lists third-party stores. A click may go through our Site and then to the store. We may add parameters such as utm_source=entrashop so the store can see the visit came from us. Some links are, or may become, affiliate links: if you buy, we may earn a commission, at no extra cost to you. The store’s own privacy policy applies after you leave.
4. Who we share data with
- Google — when the AdSense script runs, to show and measure ads.
- Email delivery — when the newsletter is on, the email service we use to send messages receives the address and the message.
- Cloudflare and our hosting provider — they process traffic and store the Site’s database. The server used for this policy is in Sydney and is reached through Cloudflare.
- Authorities, if the law requires it.
We do not sell your personal data.
5. How long we keep data
- Account email, saved stores, and recently viewed stores (up to 50): until you ask us to delete the account.
- Sessions: about 30 days without use. The password hash stays with the account until you ask us to delete it.
- Unconfirmed newsletter sign-ups: 30 days, when the newsletter is on. After you unsubscribe we keep a record that the address is unsubscribed, so we do not email it again.
- Click records: about 13 months. Daily salts: about 48 hours.
- Security counters: minutes to one hour.
- Ad data held by Google: under Google’s policies, not ours.
- Request logs: only for the short period needed for security and operations.
6. Your choices and rights
- Opt out of personalized Google ads at Google Ads Settings.
- Clear cookies and site data in your browser. That removes
es_session,es-recent, andes-podium-revealedon your device. - Clear viewing history in your account.
- Unsubscribe in any newsletter email, or in email preferences, when the newsletter is on.
- Ask us to delete your account or send a copy of your data: email [email protected] from the address on the account. We will respond within 30 days.
- Where the law gives them, you may have rights to access, correct, delete, restrict, or object, and to data portability, and to complain to a data protection authority. This includes people in the UK and the EEA.
7. Security
Sign-in tokens and sessions are stored only as hashes. The Site uses HTTPS. No system is perfectly secure.
8. International transfers
Hosting for this version of the policy is in Sydney, with Cloudflare in front. Where data moves across borders, we use an appropriate safeguard, such as standard contractual clauses, when the law requires one.
9. Changes
We will post changes on this page and change the date above. If a change materially affects account holders, we will email them.
10. Contact
Entrashop · [email protected]
The Terms of Use explain what the Site is.