Privacy policy

Sign-in and accounts

Clerk provides sign-in. For email sign-in, Clerk processes your email address and verification code. With Google sign-in, Google shares authorised basic profile details such as your name, email and picture. We link orders to your identity and show your email and purchase history in your account. PAPOMO does not receive your Google password or require access to Gmail, contacts or cloud files.

Orders and payments

We store order numbers, delivery emails, card values, amounts, order status and timestamps, plus wallet addresses, signatures, networks and transaction records used to verify JPYC payments. Your delivery email is used for codes and order support. Wallet signatures verify payment ownership. We do not request or store private keys or seed phrases.

We use Reown AppKit to connect wallets. Mobile QR and app connections relay connection, signature and transaction requests through WalletConnect. These services process network connection data, and your browser stores wallet sessions for reconnection. Wallet addresses and blockchain queries are sent to RPC services to verify balances, networks and payments. Your wallet retains control of your private keys and seed phrases.

Blockchain transactions are public records that we cannot delete or change. Past guest orders are not automatically assigned to an account merely because the email address matches.

Providers and device storage

Clerk uses cookies and similar tools to maintain sign-in and protect accounts; Google handles Google sign-in. Cloudflare provides hosting, order storage and support email forwarding. Forwarded messages are handled in the operator’s Gmail inbox. Providers may process information outside your region.

Browser local storage restores your current order. Clearing browser data may prevent guests from recovering an order themselves. Contact support with your order number if needed.

Your language choice is saved in browser cookies and local storage.

Provider privacy policies: Clerk, Google, Cloudflare.

Visit and purchase analytics

We use Cloudflare Web Analytics to understand visits and performance on public storefront pages. We also measure visits, checkout opens and wallet connections on this site. Your browser stores a random visit ID, renewed after 30 minutes of inactivity or 24 hours. Events are grouped by source category, campaign, page path and language; they do not store email addresses, wallet addresses, gift codes or full referring URLs. We also record checkout steps, wallet or network error categories, whether JPYC and gas are sufficient for this order, and optional feedback choices. We do not record exact balances, raw errors, or full wallet holdings. Leaving the page alone is not treated as abandoning payment.

Orders are associated with the visit ID to measure orders, server-confirmed payments and amounts paid. Visit records and analytics associations are retained for up to 90 days, separately from order retention. We do not record these visit analytics when your browser sends Do Not Track or Global Privacy Control. You can also opt out below.

Feedback you submit

When you submit payment feedback, we keep your selected reason, description, page language and submission time for up to 90 days to improve checkout. Only authorized staff can view it, and your description is not sent to X. You can submit feedback even when analytics is disabled; doing so does not turn analytics back on.

X ad measurement

When enabled, we use X Pixel and the Conversion API to measure store visits, checkout openings and confirmed payments. X Pixel may use cookies and receive page URLs, IP addresses and browser information. We retain X ad-click identifiers for up to 90 days. After payment confirmation for orders with an ad-click identifier, we send X a deduplication identifier, payment time, quantity and actual payment amount. We do not send delivery email addresses, wallet addresses, transaction hashes or gift codes.

The opt-out setting above and browser Do Not Track or Global Privacy Control signals also apply to X measurement. X Pixel does not load on account, privacy policy or admin pages.

X Privacy Policy

Retention, access and deletion

We retain information needed to fulfil orders, provide after-sales support, resolve disputes and meet applicable record-keeping duties. Contact support to request access, correction or deletion. We verify your identity and explain any information that cannot be deleted immediately because of open orders, disputes, record-keeping duties or the public nature of blockchains.

Signing out does not delete orders. Deleting a sign-in account does not itself delete orders or payment records; specify these separately when contacting support.

Partnerships and delivery

Partnerships are invitation-only and require support contact and operator approval. We retain referral relationships, credit changes, payment and code-allocation records to calculate rewards, apply credit and prevent duplicate delivery; existing reward records are retained. Codes are encrypted and accessible only to buyers and authorised operators. Order emails are sent through Cloudflare Email Service. Support remains at support@papomo.com. Clerk registration details are synced to the admin system for account and order management.