the short version
No ad trackers, no profile, nothing sold
There is no advertising network on this site, no tag manager, no session recorder, no chat widget and no data broker. We do not sell, rent or trade personal information to anybody, and we never have.
Almost everything the site remembers about you (your cart, your saved items, where you ship to) lives in your own browser and never reaches us. The exceptions are things you type into a box and send on purpose: an email address, or a post on the community board. Both are described below, precisely.
what stays on your device
The keys, enumerated
The site keeps a short list of values in your browser so it can remember what you were doing between visits. Because we wrote the code, we can list them all, by name:
| key | what it holds |
|---|---|
nm_age | your answer to the age gate |
nm_loc | the country and region you told us to price for |
nm_cart | your cart |
nm_board | your saved-items board |
nm_selv | which size or flavour you last picked on each product |
nm_user | the name and email you typed if you made the lightweight sign-in; it lives here, in your browser |
nm_install_hint | that you said no thanks to the home-screen prompt, so it stops asking |
nm.handle | the name you post under on the community board |
nm.age21 | your 21+ confirmation for the board |
Most of these are stored twice: in your browser's local storage, and as a first-party cookie that expires after 30 days, because some browser setups block one and allow the other. Full honesty about how cookies work: a cookie travels with your requests to our own domain, and our server does not read or keep any of them. None is readable by any other site, and none tracks you anywhere.
The app also caches its own files (the page, the styles, the engine) so it opens instantly and survives a dropped connection. That cache is copies of our code, not data about you.
You can wipe all of it at any time by clearing site data for this domain in your browser settings. Nothing breaks; the site forgets you and the age gate asks again.
what you send us on purpose
The email box, and the board
The email signup
If you give us an email address, we record the address, any name you typed, the country and region you had set, and when. It goes to our mailing list, which lives in a Google spreadsheet we control, so we can email you. That is all it is for. There is no password, ever; the sign-in on this site is your email and nothing else, and it is convenience, not authentication.
The community board
Posting on The Back Door sends us the name you typed, your post, and your confirmation that you are 21 or over. All of it is public by design: no accounts, no email, no DMs. Do not post contact details; the filter holds them anyway, for your safety as much as anyone else's.
To be removed from the mailing list, email hello@nicotiamarket.com and say so. We will delete the record; we do not require a reason and we will not try to talk you out of it.
the technical record
What our server sees
Anonymous events. When you add to cart or hand off to a store's checkout, the page sends our server a small event: what happened, which store, which product, the value, the country you had set, and when. No name, no email, no account id, no cookie. We use it to see which shelves work, not who is shopping.
Page counts. We use Vercel Web Analytics, which counts page views without cookies and without building a profile of you across sites. We use it to see which pages people read, not who read them.
The board and IP addresses. The community board uses your IP address for rate limiting: a per-minute counter that lives about two minutes and a per-hour counter that lives about two hours, so nobody can flood the board. Published posts do not store your IP. If you report a post, the report keeps the reporter's IP with it (only the most recent reports are kept), so abuse of the report button is traceable.
The site is hosted by Vercel, and like any web host their servers keep ordinary request logs, which include IP addresses. We do not use those logs to identify anyone, but they exist and we would be misleading you to leave them out.
The typefaces come from Google Fonts, so your browser makes a request to Google to fetch them, and Google sees that request. If that matters to you, it is worth knowing.
who else touches it
The short list of other companies
| who | what they get | why |
|---|---|---|
| Vercel | request logs, page-view counts | hosting and analytics |
| Upstash | the board's public posts, the product-catalogue cache, the rate-limit counters | the database behind the board and the cache |
| a font request from your browser; your signup record, if you signed up | typefaces; where the mailing list is kept | |
| The stores | your visit, if you click through | that is where you actually buy |
That is the whole list. The first three only ever see what the sections above describe, and the last one is the next section.
If you have never typed your email into this site and never posted on the board, the only trace of you anywhere in this table is an anonymous line in a request log.
when you leave
Clicking through to a store
When you click a product link you go to that store's own website, and from that point you are on their site under their privacy policy and their age check, not ours. Some of those links carry an affiliate tag, which tells the store the visit came from us so that any commission is credited. It does not tell them who you are, because we do not know either.
If a commission is later credited, the affiliate network tells us that an order happened and what it was worth. It does not tell us who placed it. What you buy, and everything you type into a store's checkout, stays between you and that store.
asking us things
Your data, and how to get rid of it
Email hello@nicotiamarket.com and ask. You can ask what we hold on you, ask for a copy, or ask us to delete it. In practice, for almost everybody, the honest answer will be "an email address, and it is gone now."
This site is for adults 21 and over. We do not knowingly collect anything from anyone under 21, and if we learn that we have, we will delete it.
If we change how any of this works, we will change this page and move the date at the top. We are not going to quietly widen what we collect and leave the old page up.
Terms: what this site is →