Privacy Policy

We collect what we need to get your order to you safely and discreetly, and to keep the shop secure:

• Details you provide — your name, delivery address, email and phone number, along with the items in your order.

• Account information — your login details (stored securely and never in plain text), whether your email is verified, your order history, any store credit or rewards balance, your marketing email preference, and, if you use the referral scheme, who referred you and who you referred.

• Payment information — handled directly by our payment providers. We never see or store your full card details on our own systems. If you pay with cryptocurrency, we keep the transaction reference and the sending wallet address needed to match your payment to your order.

• Support conversations — the messages you send through our site chat, including any photos you attach.

• Technical and security information — your IP address when you check out or sign in, and your browser and device type. We use this to keep the site working and to detect fraud and abuse.

• Usage information — only if you accept analytics (see Analytics & Cookies below): which pages you visit, which products you view or add to your basket, and how you first arrived (the referring site or campaign).

Pot Drop is only for adults aged 18 and over, and we don't knowingly collect information from anyone under 18.

Your information is used to run the service you came here for:

• To process, pack and deliver your orders.

• To keep you updated — order confirmations, dispatch and tracking notifications, and account emails such as email verification.

• To manage your account, store credit and rewards — including checking that a referral reward goes to a genuinely new customer (we compare account, email and delivery address details between the two accounts).

• To provide customer support when you reach out.

• To keep the site secure and prevent fraud, including restricting accounts that abuse the shop.

• With your consent, to understand how the shop is used so we can improve it.

• With your consent, to send you marketing emails about offers and new drops — only if you've opted in, and you can withdraw that consent at any time.

We rely on the following legal bases: performing our contract with you (orders, account, support); our legitimate interests (site security, fraud prevention, fixing errors); your consent (analytics, and marketing emails); and our legal obligations.

We will never sell, rent or trade your personal information. Ever.

Privacy and security are at the core of everything we do:

• All data is transmitted over encrypted, TLS-secured connections.

• Information is stored on secure servers with strictly limited access.

• Card payments are processed only through trusted, PCI-compliant payment providers — your card details never touch our systems.

• Every order is sent in smell-proof, unbranded, low-profile packaging, with no trace of what's inside — your privacy extends all the way to your doorstep.

• We practise data minimisation: we hold only what's necessary, for only as long as it's needed.

We share your information only with the services needed to run the shop, and never for marketing by third parties:

• Delivery — only the details required to get your parcel to you, such as your name and address.

• Payment providers — to process your payment securely.

• Email delivery — to send your order and account emails.

• Cloudflare — our site is delivered through Cloudflare, which protects it against attacks and provides anonymous performance measurements.

• Address lookup — when you enter a postcode at checkout, your browser checks it with a postcode-lookup service, which receives the postcode and your IP address.

• Hosting, database and error-monitoring providers — the services that run our servers, store payment records and alert us to technical faults.

• Support notifications — when you message us in the site chat, our team is alerted through a secure messaging app with your name (or the first part of your email address if you're checking out as a guest) and a short preview of your message.

• Analytics — only if you accept analytics, our analytics service receives information about how you use the shop (see below).

Each of these services receives only what it needs, may use it only to provide its service to us, and never for its own marketing.

Some of these providers are based outside the UK. Where your information is transferred abroad, it is protected by UK adequacy regulations or the UK's approved data-transfer contract terms.

Essential storage — always on. To make the shop work we store a small amount of data in your browser: the items in your basket, your sign-in, your support-chat identity and the analytics choice you make on the banner. We may also keep, for a few minutes after a card order, the link to finish paying for it, and your basket for up to a day so you can restore it. None of this is used to track you.

Product-view counter — always on. Separately, we count how many different visitors viewed a product today, using a short-lived anonymous token that is discarded within 48 hours and never linked to you — this powers the "eyeing today" counter and runs for everyone.

Optional analytics — only if you accept. When you first visit we ask whether we may use analytics. If you accept, three things switch on: our analytics service, which sets its own cookies and receives the pages and products you view; our own first-party analytics, which keeps a random session identifier in your browser and records only aggregate counts on our servers; and a note in your browser of how you first arrived (the referring site or campaign), which is added to your order if you place one. If you decline, none of these run and no analytics cookies are set. Before you choose, and if you decline, no analytics script is loaded and nothing is sent to our analytics service.

Error reporting — always on. If a page breaks in your browser, it sends us the error message and the page address (without any query string) so we can fix it. This contains no personal data and is not analytics.

You can change your analytics choice at any time using the Cookie choices link at the bottom of every page. Withdrawing consent stops analytics immediately and deletes the analytics cookies and data stored in your browser.

We keep your information only for as long as needed to provide the service. Order records are kept for as long as we need them for deliveries, support, disputes and fraud prevention.

The IP addresses you check out from are kept on your account while it is open and removed when you delete your account; the IP recorded with each order is kept with that order record. Our own analytics counts are kept for a few months and are aggregated, so they cannot be traced back to you. Backups are kept for a short rolling window and then deleted automatically.

When information is no longer required, it is securely deleted — and you can ask us to delete it at any time.

Your information belongs to you, and you stay in control of it. At any time you can:

• Access the personal information we hold about you.

• Correct anything that's inaccurate or out of date.

• Delete your account — which removes your personal data from our live systems, apart from the minimum we must keep for fraud prevention or where the law requires it.

• Object to or restrict how we use your information, or request a copy of it.

• Withdraw your analytics consent at any time using the Cookie choices link in the footer.

• Turn marketing emails on or off at any time in your account profile, or use the unsubscribe link in any marketing email.

We will always act on these requests promptly and free of charge. If you're unhappy with how we've handled your information, you also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

If you'd like to exercise any of your rights, delete your data, or simply ask a question about your privacy, get in touch any time — we're happy to help.