Privacy policy

Draft of 5 October 2026

This policy explains what personal data Alphabibi collects, why, and what you can do about it. The controller is Travis Worthing, British Columbia, Canada. Contact: hello@alphabibi.com.

What we collect and why

• Orders. When you buy, Paddle (our Merchant of Record) collects your payment details, email address and country. We never see your card details. Paddle shares with us your email address, country, what you bought and the order number, so we can deliver your downloads, answer support requests and keep tax and accounting records. Legal basis: performing our contract with you, and legal obligations.
• Downloads. When you download a pack, we record the time, which file you downloaded, your approximate country and internet provider (from Cloudflare), how much of the file was transferred, a shortened browser identifier and a one-way keyed hash of your IP address (never the address itself), and we keep these records for 18 months after your order to prevent fraud and resolve refund and chargeback disputes. Legal basis: legitimate interest in preventing fraud and handling disputes.
• Waitlist. If you ask to be told when a letter goes on sale, we store your email address, the letters you chose, the page you signed up on, and when and to what wording you agreed. We first send one email asking you to confirm; nothing else is sent until you do. After that we email you only when your letters go on sale. Every email has an unsubscribe link. Legal basis: your consent, which you can withdraw at any time.
• Resending links. If you ask us to resend your download links, we use the email address you enter only to look up your orders and send the links, and we log the request to limit abuse.
• Emails to us. If you email us, we keep the conversation to answer you.
• Server logs. Our host (Cloudflare) processes IP addresses and request data to serve the site, rate-limit abuse and keep it secure.

What stays in your browser

The shop remembers the name you typed and the edition you picked in your browser's local storage, so they are still there next time. That data never leaves your device. We do not use analytics, advertising or tracking cookies.

Who else processes data

• Paddle (payments, tax, invoices, refunds): see Paddle's privacy policy. Paddle's checkout script loads from cdn.paddle.com only when checkout is open for sale.
• Cloudflare (hosting, order database, file storage, sending order emails).
• Google Fonts: your browser loads the Fredoka font from Google, which sees your IP address.

We do not sell or rent your personal data.

How long we keep it

• Order records: as long as tax and accounting law requires (often 6 to 10 years), then deleted.
• Download records: 18 months after your order.
• Waitlist: until you unsubscribe or ask us to delete it. If you never confirm, the confirmation link expires after 7 days and we send nothing more.

Your rights

You can ask to see, correct, export or delete your personal data, object to its use, or withdraw consent, by emailing hello@alphabibi.com. We answer within 30 days. You can also complain to your local data protection authority.

International transfers

Paddle and Cloudflare may process data outside your country. They use safeguards such as standard contractual clauses.

Children

Alphabibi is meant for streamers aged 13 and over, as on Twitch. We do not knowingly collect data from children under 13.

Changes

If this policy changes, we will update this page and its date.