Privacy Policy

Last updated: 12 October 2026

Thinklery Group Pte. Ltd. (UEN 202405942H), 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051 ("we") runs this shop. This page says what we collect, why, who helps us, how long we keep it, and what you can ask us to do.

Who to contact

Our Data Protection Officer is Jarrod Chua. Email jarrod@thinklery.com about anything on this page, to see or correct what we hold about you, or to ask us to delete it.

What we collect, and why

Your order (name, address, email, phone, what you bought, and any gift or order note): to sell and deliver it, write to you about it, and keep the records the law requires. Basis: contract; legal obligation.
Your account, if you make one (your name, the picture and rank beside it, your coins and their history, and your birthday if you give it): to let you sign in, see your orders, and collect and spend coins. Basis: contract.
Your email for a one-time note (such as "tell me when it is back"): to send that note. Basis: consent.
Your email for your quiz reading, if you ask for it: to send you the reading once. Basis: consent.
Your email for our letters: to send them. With your sign-up we keep a record of your consent: the page, the words you agreed to, when, and the IP address and country it came from. Basis: consent, which you can withdraw at any time.
A message you send us: to answer it. Basis: legitimate interest.
A review you write when we invite you: to show it on our site. Basis: consent.
Visits (pages, the site that sent you, a scrambled form of your IP address and browser): to see how the shop is used, with no cookie and nothing that identifies you. Basis: legitimate interest.
Server logs and error reports, which can include your IP address or order details: to keep the site and our order system running and safe. Basis: legitimate interest.

We do not sell your data and we do not use it for personalised advertising.

Age

To give us your email anywhere on the site, you must be 16 or older. If you are younger, a parent or carer can give their own email instead. To place an order, you must be 18 or older. If we learn we hold the details of someone under 16 without a parent's consent, we delete them.

Who helps us

Shopify: our shop, checkout, payments, orders and accounts (Canada, Ireland, Singapore and other countries where Shopify works). Your card details go to Shopify's payment providers, never to us.
Vercel: hosts the website (United States).
Plausible Analytics: counts visits with no cookie (European Union).
Resend: keeps email sign-ups and consent records, and sends the emails you asked for (United States).
Google: our email and team chat, where your messages and order alerts reach us (United States and other countries where Google works).
Judge.me: collects and shows reviews (United Kingdom, with storage in the United States).
OpenAI: helps us draft the personal email a character sends you about your order (your first name, what you ordered and any gift or order note) and our replies to your emails (the email thread), and translates tracking updates (United States).
Hetzner: runs our order system, which handles orders, deliveries and coins (Germany).
Supabase: our database provider, which holds our order system's records: orders, deliveries, accounts and coins.
Amazon Web Services: keeps backups of our order system.
Sentry: tells us when our order system has an error. An error report can include order details.
17TRACK: follows your parcel using its tracking number.
Delivery companies (such as SingPost and J&T Express): get your name, address and phone to deliver your parcel, in Singapore and in the country it travels to.

Where your data leaves Singapore, the EU, the UK or Switzerland, we rely on the safeguards the law allows, such as the EU's standard contractual clauses (and the Swiss and UK versions where they apply).

Cookies and storage in your browser

No cookie on your first visit.
tl_cart, 30 days: your cart. tl_ca_sess, 30 days, and tl_ca_oauth, 10 minutes: your sign-in. The shop cannot work without these.
tk_lang, one year: remembers the language you chose.
tk_country, one year: remembers the country you picked, set only when you pick one.
tk_sky, one year: remembers your quiz result, so the shop can show it to you. tk_sky_card, one year: remembers if you folded your result card away. tk_crest, one year: remembers the picture you chose to show beside your name.
tl_attr, 30 days: set only when you arrive from one of our links, to tell us which link brought you. We do not set it for visitors in the EU, the EEA, the UK or Switzerland.
Your browser also keeps your wishlist, your trail on our map, and your quiz, sound and map settings on your own device. We never see them.

How long we keep it

Orders and invoices: at least five years after the end of the financial year of your order, as Singapore law requires.
Your account and coins: while you have an account. Ask us and we delete it.
Your email for a one-time note: deleted within 30 days of sending that note.
Your quiz reading email: we send it once, and it does not put you on any list unless you also tick the box for our letters.
Your email for our letters, and the record of your consent: until you unsubscribe or ask us to delete it.
Messages to us: two years after our last reply.
Server logs: kept briefly by our host, then deleted.

Your rights

You can ask to see what we hold about you, correct it, have it deleted, limit how we use it, or receive it in a form you can take elsewhere. You can object to anything we do on the basis of legitimate interest, and you can withdraw a consent at any time: use the link in our letters, or simply write to jarrod@thinklery.com. We answer within 30 days. You can also complain to Singapore's Personal Data Protection Commission, the Swiss Federal Data Protection and Information Commissioner, the UK Information Commissioner's Office, or the data protection authority where you live in the EU.

Changes

If we change this page, we update the date at the top.