guest@stealthline:~$help --topics
guest@stealthline:~$cat ./privacy
Stealthline Shop is operated by Stealthline, an Australian sole trader, ABN 52 656 939 154. We are the business responsible for the personal information described here — the “data controller”, in the language of European law.
For anything at all in this policy, including a request to see, correct or delete your data, or a complaint:
A person reads that mailbox and answers that phone. You are welcome to deal with us under a pseudonym for a general enquiry; we will only need your real name and address when there is something to post to you.
Australia. We apply the Australian Privacy Principles under the Privacy Act 1988 to everything described in this policy.
The United Kingdom and the European Union. We ship to the UK and to EU member states, so the UK GDPR and the EU GDPR apply to those orders. Where they do, sections 7, 11 and 17 set out the lawful bases we rely on, the rights you have, and the regulator you can complain to.
The United States. See section 12 — the short version is that California’s privacy law sets thresholds we are far below, and we give you the same rights anyway.
When you place an order, whether or not you have an account:
If you create an account, which you never have to do in order to buy something:
If you write a review: your rating and the text you write, shown publicly on the product page with your username beside it. Your email address is never shown, and reviews are only possible for something you actually bought.
Australian law has a defined category of “sensitive information” — health, racial or ethnic origin, political or religious beliefs, sexual orientation, criminal record, biometric and genetic data. European law has a near-identical list it calls special category data. We do not ask for any of it, and there is nowhere on this site to give it to us. Please do not put any of it in a review or an email to us.
The phone configuration you choose, and any Additional comments you write with it, are not on either of those legal lists. We are telling you about it here anyway, because the legal definition is not the same as what actually reveals something about a person: a record that a named individual at a known street address asked for a camera to be physically removed says a great deal about how they want to live.
So we treat it as the most revealing thing we hold. That is the reason it has its own, much shorter retention period in section 10 rather than simply living on the invoice for as long as the tax office requires the invoice to exist.
These are specific claims about this website rather than reassurance, and each one is a thing you could verify:
There is one cookie: a sign-in session cookie, set only if you log in, which exists so that you stay logged in as you move between pages. It is removed when you sign out.
There are no analytics cookies and no advertising cookies, which is why this site shows you no cookie banner — there is nothing here to consent to and nothing to opt out of.
Your shopping basket is kept in your own browser’s local storage. It stays on your device and is only sent to us at the moment you check out. Clearing your browser data clears it, and we never see a basket that was not checked out.
Each purpose is listed with the lawful basis we rely on where the UK or EU GDPR applies:
We use a small number of named service providers, and each sees only what it needs to do its job:
That is the complete list. We will add to it only by updating this page, and we do not pass your information to anyone else.
We will also disclose information where the law genuinely requires it. If we receive a legal demand for customer data we will comply only to the extent we are actually obliged to, and we will tell you it happened unless we are prohibited from doing so.
Some of the providers in section 8 are located outside Australia: the United States (Stripe, Google, Cloudflare and our email provider), the European Union (where those providers operate European infrastructure), and Switzerland (Proton Mail). Using them means your information is processed overseas by them.
An overseas delivery address goes further than that. Australia Post hands an international parcel to the postal service of the country it is going to, so your name and address are disclosed in that country and handled under its laws rather than Australia’s. That is unavoidable if you want the parcel to arrive, and we would rather say so than leave it unmentioned.
We choose providers that publish their own privacy and data-transfer terms, and we send them the minimum each one needs. We do not transfer your information overseas for any other reason, and we do not store our own records outside Australia.
Order and payment records: 5 years from the date of the order. This one is not our choice — tax law requires business records to be kept, so a request to delete your data cannot remove an invoice we are legally required to hold.
The configuration you chose — camera, VPN, software — and anything you wrote in the Additional comments box is kept against your order for 12 months, which covers fulfilment and the warranty questions that follow it. After that it is erased automatically: not archived, not anonymised, overwritten in the order record, while the invoice and the amount remain. We keep this period deliberately short for the reason given in section 4.
That erasure is done by a scheduled job rather than by hand, so it does not depend on anyone remembering. The figure above is read by that job from the same place this page reads it, which is what stops the number you are being shown from drifting away from the number actually enforced.
Account details: until you ask us to close the account.
Reviews: until you delete them or close your account.
Password reset links: one hour, and only a one-way hash of the link is ever stored, so a copy of our database does not hand anyone a working link.
Wherever you live, you can ask us to:
Write to [email protected], or call 0422 246 203. We will respond within 30 days and we will not charge you. We will not ask you to create an account to exercise a right, and asking will never affect the service you get.
If the UK or EU GDPR applies to you, you also have the right to object to processing based on legitimate interests, the right to restrict processing while a dispute is resolved, and the right to withdraw any consent you have given — withdrawing it does not undo what was done beforehand.
California’s privacy laws, the CCPA and CPRA, apply to businesses above certain thresholds: roughly 25 million US dollars in annual revenue, or the personal information of 100,000 or more consumers, or half of revenue earned from selling personal information. We are below all three, so those laws do not currently apply to us.
We are telling you anyway, because two of the questions those laws exist to answer have answers worth stating plainly: we have never sold or shared your personal information as those terms are defined, and we offer no discount or reward in exchange for your data. There is no “do not sell my information” link on this site because there is nothing for it to switch off.
The rights in section 11 are available to you wherever you live, including anywhere in the United States.
The site is served over HTTPS. Passwords are stored as scrypt hashes with a per-account salt, which means we cannot read them and neither can anyone who steals the database. Accounts created with Google have no password stored here at all. Card numbers never reach our systems. Access to the order database is limited to the people who need it to pack and post orders.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach occurs that is likely to cause you serious harm, we will tell you and notify the Office of the Australian Information Commissioner. Where the UK or EU GDPR applies we will also notify the relevant regulator within 72 hours of becoming aware of it.
No automated decisions are made about you. Nothing here scores, ranks, profiles or judges you, and no decision with a legal or similarly significant effect is made by software. The only thing worked out automatically is your postage, from the country and postcode you type in.
We do not send marketing. There is no mailing list, no newsletter, and nothing to unsubscribe from. The only email we ever send is about an order you placed or a password reset you asked for. If that ever changes we will ask you first, and it will be something you opt into rather than out of.
This shop is not intended for children, and we do not knowingly collect information from anyone under 16. If you believe a child has given us their details, write to [email protected] and we will delete them.
Where a change materially affects what we do with information we already hold, we will tell you by email rather than quietly editing this page and hoping you do not notice.
If you think we have mishandled your information, tell us first — [email protected], or 0422 246 203. We will acknowledge you within 5 business days, investigate, and reply in writing telling you what we found and what we are doing about it.
If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the United Kingdom you can complain to the Information Commissioner’s Office at ico.org.uk, and if you are in the European Union you can complain to the data protection authority in your own country. You do not need our permission to do any of that.
See also our terms, and contact for anything not covered here.
guest@stealthline:~$cat ./cart
cat: ./cart: No such file or directory