Privacy Policy
What we collect, why, who we pass it to — and, just as plainly, the parts we have not settled yet.
Last updated 5 August 2026
How this page was written. Rather than copy a template, we went through our own code and wrote down what it actually does. That means two things. First, everything below is something our system genuinely does today. Second, where our code could not tell us the answer — how long a log file survives on the server, for example — we say so instead of inventing a number. Those gaps are collected in section 8, and we would rather show them to you than paper over them.
1. What we collect
Account details. When you register or sign in, your email address and password are passed straight through to the DogeGoo shopping backend that holds your account. These storefront pages do not keep your password, and our own logs of registration and sign-in deliberately record neither your email address, your password, nor your login token — only whether the attempt succeeded and, if not, a short error code.
Shipping addresses. Recipient name, address, city, country, postcode and phone, as you enter them when you add or edit an address. We forward these to the shopping backend, which is where your address book lives.
Orders, parcels and wallet activity. The items you buy, the parcels you submit, the declared values you enter for customs, shipping lines you choose, and wallet top-ups and withdrawals. Order numbers and withdrawal amounts also appear in our server logs so we can trace a failed payment or a stuck parcel.
Support conversations. Everything you type into the chat assistant is stored, word for word, along with the assistant's replies, the page you were on when you asked, the language we answered in, and any order number the conversation touched. If you are signed in, the conversation is also tagged with your DogeGoo account id so a human agent can see who they are talking to rather than asking you to repeat yourself. Your login token itself is never stored — only a one-way fingerprint of it, used to check that whoever reopens a conversation is the same visitor who started it.
Images you upload. Photos you submit to image search, and any image you attach to an order or a support ticket.
Technical logs. Ordinary web-server records of requests to the site. Our own application logs additionally record your IP address and browser user-agent string when a request trips our rate limiter or our anti-scraping check.
What we do not collect. There is no advertising, analytics or session-recording code anywhere on these pages — no Google Analytics, no Tag Manager, no Meta pixel, no Hotjar or similar. We checked the whole codebase rather than assuming. We also never see your card number: card details are entered on the payment provider's own page, and all we send them is an order reference.
2. Why we collect it
Account details and addresses exist so we can buy your items and ship them to the right place. Order, parcel and wallet records exist because they are the service itself — and because you need to be able to look back at what you paid for. Support conversations are kept so a human agent can pick up where the assistant left off, and so we can find out where our answers were wrong; several fixes to this site came directly from reading conversations that went badly. Technical logs exist to keep the site up and to fend off the scrapers that hammer product pages.
3. Where it is stored and who can see it
Your account, orders, addresses and wallet live in the DogeGoo shopping backend. These storefront pages hold a smaller, separate store of their own: support conversations, site content, and operational logs.
Two groups of staff have access, through two separate logins. Support agents can read conversations and reply to you; they cannot change anything else on the site. Operations staff maintain the site's content. Agent accounts are individually issued and their passwords are stored only as salted hashes, never in readable form; an agent's session expires after twelve hours and revoking an account takes effect on their next click.
4. Who we send your data to
This is the section most privacy policies are vague about, so here is the full list of parties that receive data because of something you do on this site.
| Who | What reaches them |
|---|---|
| The DogeGoo shopping backend | Nearly everything account-related: sign-in credentials as you submit them, your session token, addresses, cart, orders, parcels, customs declarations, wallet top-ups and withdrawals, support tickets, and any file you upload. |
| Payment providers | An order reference and your chosen payment method, in exchange for a payment page. Your card details are entered on their page, not ours — we never receive, store or log them. |
| Our AI model provider | Your chat messages. See section 4a below — please read it before typing anything sensitive into the chat box. |
| Our image-search supplier | The full photo you upload to image search, sent upstream to find matching listings. |
| Cloudflare | All traffic to this site passes through Cloudflare before reaching us, so they see the IP address, browser and URL of every request. Our servers read the visitor IP from Cloudflare's headers. |
| Google Fonts | Every page on this site, including this one, loads two typefaces from Google's font servers. That request carries your IP address and browser user-agent to Google. It is the only non-essential third-party request the site makes, and we are aware it is avoidable — see section 8. |
| Product-data suppliers | Search keywords and product ids only, when we refresh listing data. No customer data of any kind is sent to them. |
4a. The chat assistant, in detail
Our support widget is powered by a third-party large language model reached through an API relay. When you send a message, what leaves our server is: the text you just typed, and up to the last six messages of that same conversation for context. If an earlier turn involved our system looking up your order, that context can include a real order number, parcel status or tracking number.
We cannot tell you what that provider does with it. We have not been able to independently verify their retention or training practices, so we are not going to make a promise on their behalf. What we can tell you is what we send, which is the paragraph above. Our API keys and your login token are never part of it. If you would rather a third party never saw a particular detail, email us at [email protected] instead of using the chat box.
5. Cookies and browser storage
We set three cookies. None of them are advertising cookies.
| Cookie | Purpose | Lifetime |
|---|---|---|
dg_tk | A signed page token that lets our servers tell real browsers apart from scrapers. It identifies a browsing session, not a person. Sent only to our own shop endpoints. | 4 hours |
dg_cs | Login session for our own support-desk staff. Never set for customers. | 12 hours |
dg_ref | Referral attribution. If you arrive from a creator's page or a link carrying a referral code, we remember the first code you arrived with so that creator is credited when you register. | 1 year |
Of the three, dg_ref is the only one that follows you across visits for a commercial rather than a technical reason, it is readable by scripts on the page, and one year is a long time. We are flagging it rather than burying it; see section 8.
We also keep things in your browser's own storage, which never leaves your device unless a section above says otherwise:
| Stored item | What it holds |
|---|---|
| Login token | Your sign-in token, so you stay logged in. Cleared when you sign out or when it expires. |
| Chat session id | Lets your support conversation continue as you move between pages. Cleared on sign-in and sign-out. |
| Guest cart | Items you add before signing in: product id, platform, variant, quantity, title, image and price. Because this lives in the browser rather than in an account, anything added on a shared device stays visible to the next person using it, which is why we never merge a guest cart into an account without asking you first. |
| Lists | Wishlist and group-buy lists. Stored per account id so two people on one device do not see each other's lists. |
| Referral code | The same referral code as the cookie above, kept twice so it survives to registration. |
| Reminder and notice state | Which prompts you have dismissed, and a short-lived cached note of whether you have an unpaid order, so we do not nag you on every page. This includes your account id and, briefly, an order number. |
| Preferences | Language, currency, cached exchange rates, and whether you ticked "do not show this again" on the order-confirmation notice. |
Clearing your browser's site data removes all of the above. Doing so signs you out and empties a guest cart.
6. How long we keep things
Honestly: we have not yet set a formal retention schedule, and we are not going to print a number we cannot stand behind.
What we can state accurately today is that our support conversations, their operational log entries and our support-quality logs currently have no automatic deletion at all — they accumulate. Web-server access logs are rotated by the server in the ordinary way, but we have not committed to a fixed period for them, so we will not claim one. The only durations we can quote with confidence are the cookie lifetimes in section 5, because those are enforced by your browser.
Setting a real retention schedule, and building the job that enforces it, is outstanding work. We would rather tell you that than publish a comfortable-sounding figure.
7. Your choices
Getting a copy of your data, or having it deleted. Email [email protected] from the address on your account and tell us what you want. Two caveats we would rather you heard from us than discovered later: there is no self-service export or delete button anywhere on this site, and your account itself lives in the shopping backend, so a request has to be actioned there by a person. We have not yet committed to a turnaround time for these requests — see section 8.
Cookies. There is currently no cookie banner on this site, because until now the only cookies we set were the technical ones. You can clear or block cookies in your browser at any time; blocking them will sign you out and may cause product pages to stop loading data, since the anti-scraping token rides on a cookie.
The chat assistant. Using it is optional. Section 4a explains where your words go; email works instead.
8. What this policy does not yet answer
Everything above is something we could verify. The following are things we could not, and we would rather list them openly than fill the space with boilerplate. Each is genuine outstanding work on our side.
- Retention periods. We have no formal schedule and no automatic deletion of support conversations. This needs to be decided and then actually implemented.
- Turnaround for data requests. We have not committed to how quickly we respond to an export or deletion request, or to a dedicated privacy mailbox. For now, use [email protected].
- Legal framework. This page makes no claim of compliance with GDPR, CCPA, PIPL or any other regime, and does not name a governing law, a data protection officer or an EU representative. We have not carried out a compliance assessment, so saying otherwise would be a lie. We do have customers in the EU, and this is on our list rather than dismissed.
- Minimum age. We have no age requirement, age gate or parental-consent process, and no policy on younger users. Not decided.
- Google Fonts. As noted in section 4, loading fonts from Google sends every visitor's IP address to Google. Hosting the fonts ourselves would remove this entirely and we know it is straightforward. Not done yet.
- The one-year referral cookie. A twelve-month, script-readable cookie set purely for attribution is longer-lived and less essential than the rest. Whether to shorten it or put it behind a consent prompt is undecided.
- What our AI provider does with chat text. Unverified, as explained in section 4a. We will not guess on their behalf.
- Company details. The legal entity behind DogeGoo is not printed here yet. We hold a candidate on file, but our Trustpilot profile lists a different jurisdiction, and we would rather leave it blank than print a contracting party we have not reconciled. Ask us and we will tell you where it stands. The same note appears in section 13 of our Terms of Service.
If one of these matters to you before we have resolved it, ask us directly and we will tell you where it stands.
9. Contact
Privacy questions, data requests, or anything on this page you think is wrong: [email protected]. If something here does not match your experience of the site, we would genuinely like to know — this page was written from our code, and code changes.
More about DogeGoo: about us · our Trustpilot page