Privacy Policy

The shop is built on the Nostr protocol and is deliberately minimal about data: there are no shop accounts and no customer database.

What goes over Nostr

• Orders are sent as end-to-end encrypted direct messages to our Nostr key. Relays carry the encrypted events but cannot read the contents — including your delivery address. Contact-form messages are covered under “A note on Nostr” below.
• Public activity — replies and zaps you post are public Nostr events signed by your key, visible to anyone, and outside this site's control once published.

What we use your details for

The delivery details in an order are used solely to fulfil that order. We delete address data once delivery is confirmed (plus any statutory period we're required to keep records for), and we never share it or use it for anything else — no mailing lists, no third parties.

Payments

Payments are Bitcoin Lightning invoices. We never see card numbers or bank details — there are none involved.

A note on Nostr

Contact-form messages from visitors who aren't signed in with Nostr are emailed to hello@knowall.ai through our Microsoft 365 tenant, where we keep them as ordinary business email. If you're signed in with Nostr, your message is also sent as an end-to-end encrypted direct message to our Nostr key over public relays: relays (which we don't operate) can see that an encrypted message passed between two keys and when, but not its contents. Reviews, replies and zaps are public Nostr events signed by their authors and visible network-wide.

Website visits and Sallie

Across www.knowall.ai we count visits without cookies or anything else stored on your device, so there is no consent banner. When a page loads, your browser tells our own server which page it was and, on arrival, which site linked you here (without its query string). The server turns your IP address and browser into an anonymous code using that day's salt, a secret key that changes every day and is only held in memory for the day, so a visit can be counted once but you can't be followed from day to day, and the code can't be turned back into your address. Your full IP address isn't kept for this or sent on: only its network part goes to Microsoft Azure Application Insights, in the UK, to work out the country and city, and Application Insights then discards it. These records are kept for 90 days.

If your browser sends Do Not Track or Global Privacy Control, your visits aren't counted at all.

Conversations with Sallie, our AI assistant, are kept so we can follow up and improve her: what you wrote and her replies, the page you were on and the country you were in, for 90 days. The website server also keeps its own chat log, with your IP address, to stop abuse; entries in it are deleted after 30 days. Please don't share anything sensitive with her. With Do Not Track or Global Privacy Control on, the conversation is kept without a location or visitor code. Email hello@knowall.ai to have a conversation deleted.

Questions

Message us on Nostr or email hello@knowall.ai if you have any questions about your data.