Last updated: 2 September 2026
Who is responsible?
This website is operated under the trading name MRSCOOKIESCASH4CRAP. The operator is responsible for personal information processed through the site. For privacy questions or requests, email [email protected].
Information we use
Contact and correspondence
If you use the contact form or email us, we may receive your name, email address, reason for contact, message and subsequent correspondence. The current website contact sender is not connected to an email provider and deliberately does not log message bodies or email addresses.
Accounts and sign-in
If you create or use a Cookie account, we process your email address, optional display name, account creation date, last sign-in time and account status. Sign-in is passwordless: we send a short-lived, single-use link and retain only a cryptographic hash of the usable token. We may also process a one-way fingerprint of the requesting IP address to limit abuse; raw sign-in tokens are not stored or logged.
Notifications and devices
If you choose notification preferences, we store the topics and channels you select. Browser push requires your express action and permission. For each registered browser we store an encrypted push endpoint and encrypted push authentication material, an endpoint fingerprint, a general browser/device label, creation and last-used dates, and whether the subscription was revoked. In-site notifications include their title, message, destination, date and read status. Optional content emails remain off unless you enable them; transactional sign-in emails are separate.
Website and security information
The website and its hosting infrastructure may process IP addresses, request paths, dates and times, browser or device details, error information and security events so the service can operate, resist misuse and be repaired.
Direct shop information
When the direct website shop opens, it may process the customer’s name, email, delivery and billing addresses where needed, telephone number where collected, products ordered, prices, order history, transaction identifiers, returns or refunds and customer-service correspondence. The checkout must identify its payment provider before launch. Complete card details should be handled in the provider’s secure payment process, not sent to us by email or contact form.
Optional analytics
If you choose “Accept analytics”, Google Analytics may receive visited pages, interactions, referring source, browser or device information and approximate location derived from an IP address. Analytics remains off before consent. See the Cookie Policy.
Anthem preference
The Cookie Crew Anthem player stores whether autoplay is on or off in your browser’s local storage. That preference remains on your device, is not sent to us and does not record whether or how long you listen. The audio file is served directly by this website.
Why we use it and our lawful bases
- Enquiries: to read and respond, based on our legitimate interest in managing genuine correspondence or steps you ask us to take before a possible contract.
- Direct orders: to take payment, fulfil orders, deliver goods and handle service requests, because this is necessary for the contract with you.
- Records: to keep legally required tax, accounting and consumer records, based on legal obligation.
- Security and fraud prevention: to protect visitors, the website and transactions, based on our legitimate interest in operating a safe service and, where applicable, legal obligations.
- Accounts and requested notifications: to provide the account, sign-in, in-site notifications, data export and deletion features you request, based on performing that service and our legitimate interest in operating it reliably.
- Optional browser push and content email: to send the topics you select, based on your choice and, where consent is required for electronic marketing, your consent. You can switch each optional channel off in your account.
- Analytics: to understand and improve website use, based only on your consent. You can withdraw it through “Cookie settings” in the footer.
- Anthem autoplay preference: to remember the player setting you request, based on providing that feature. You can change it on the player at any time.
Who receives information?
Information may be processed by the website hosting provider and technical suppliers needed to operate and secure the site. If analytics is accepted, Google processes analytics information. When the direct shop opens, the configured payment provider and delivery service will receive the information needed for payment and fulfilment. Their identities will be added when selected rather than guessed now.
The configured transactional email provider processes the email address and message needed to deliver sign-in links. If browser push is enabled, the browser vendor’s push service routes encrypted notification payloads to that browser. The final email provider and its location and safeguards must be added here before account emails go live.
We may also share information with professional advisers where genuinely necessary, or with courts, regulators, law enforcement or other authorities where the law requires or permits it. We do not sell personal information.
International processing
Some suppliers, including Google, may process information outside the UK. Where UK personal information is transferred internationally, the responsible organisation must use a lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, as applicable. Supplier locations and safeguards must be checked again when the shop, payment, delivery and email services are selected.
How long do we keep it?
- Contact enquiries: until the enquiry is resolved, then only while reasonably needed for follow-up, disputes or legal obligations.
- Orders and accounting: for the period required by tax, accounting and contract law, with the final schedule to be confirmed before shop launch.
- Returns and refunds: while the matter is active and afterwards only while needed for accounting, legal claims or consumer obligations.
- Security and server logs: only while reasonably needed to investigate security, abuse, faults and service reliability, subject to the host’s configured schedule.
- Analytics: according to the configured Google Analytics property retention controls, with data deleted or aggregated when it is no longer needed for site-use analysis.
- Magic-link records: expired token records are removed after seven days; the usable raw token is never stored.
- Account and preferences: while the account remains active, then removed through self-service deletion unless a future legal retention duty applies to a separate order record.
- Push devices: until you remove the device, the browser subscription is permanently rejected, or you delete the account.
- In-site notifications: while the account remains active or until an operational retention schedule is introduced and published.
We may keep particular information longer where a legal obligation, complaint or claim requires it. Final operational periods are controlled centrally and must be confirmed before the direct shop launches.
Your rights
Depending on the information and lawful basis, you may have rights to ask for access, correction, deletion, restriction, objection or data portability. These rights are not absolute in every situation. You may withdraw analytics consent at any time without affecting earlier lawful processing.
Signed-in users can download a structured JSON copy of their account information and can delete the current account data through Security & data. A fresh sign-in is required for deletion. Optional email and browser-push choices can be withdrawn in Notifications, and individual browser devices can be removed in Devices.
You have the right to object to processing based on legitimate interests. Email [email protected] to make a request. We may need enough information to verify your identity.
Complaints
Please contact us if you are concerned, but you also have the right to complain to the Information Commissioner’s Office (opens in a new tab). Contacting us first is not a condition of using that right.
Children
The site is intended for a general audience. We do not knowingly seek children’s information beyond what is reasonably necessary for an ordinary transaction. A parent or guardian can contact us about a child’s information.
Whatnot, YouTube and TikTok
Following a link takes you to an independent platform with its own privacy practices. This site uses links and thumbnails rather than automatically loading YouTube players or TikTok content, reducing unnecessary third-party tracking before interaction.
Changes
We will update this policy when the site’s actual data use or suppliers change and show the new update date.