Last updated: September 6, 2026 · Effective immediately
D'Online Store operates donlinestore.com and the Daily Invoice Maker application. We are a small independent software business. You can contact us at support@donlinestore.com.
Account information: When you register, we collect your email address, name, and an encrypted password hash. We do not store your plain-text password.
Payment information: Payments are processed by Stripe and PayPal. We store only the transaction ID and amount — never your card number, bank details, or PayPal credentials.
License activation: When you activate a license, we store an anonymised device identifier (a one-way hash) to enforce the 2-device limit.
Site visit logs: When you browse donlinestore.com, our own server records each page view together with your IP address,
the page you visited, the site or search engine that referred you (including any search terms or campaign tags in that link), your browser,
operating system, screen size and language, the time you spent on the page, and an approximate location (country, region and city) derived
from the IP address. We use this to count visitors, spot automated bot traffic and understand which pages and sources bring people to the site.
This is our own first-party log — it is not shared with advertising networks and does not require your consent to run, because it is limited
to what a web server ordinarily sees when serving a page. Visit logs are kept for up to 24 months and are only viewed by us.
What we do NOT collect: Your invoices, customers, expenses, receipts, business revenue, or any data you enter into the app. All of that is stored locally on your device.
We use your information solely to:
Your account data is stored on servers hosted by DreamHost in the United States. Passwords are hashed using bcrypt and are never stored in plain text. All connections to this website use HTTPS (TLS encryption). We take reasonable technical measures to protect your data but no system is 100% secure.
Essential. A session cookie named auth_token
keeps you logged in. It holds no personal information — only an encrypted session identifier — and expires after 30 days or when you sign out.
A second cookie, dim_consent, records your tracking
choice so we do not have to ask again. Essential cookies always run, because the site cannot sign you in or take a payment without them.
First-party visit measurement. Our own visit log (see section 2) uses no cookies. It stores a random visitor identifier in
your browser's local storage so we can tell new visitors from returning ones; it contains no personal information and is never sent to any
third party. Clearing your browser's site data removes it.
Advertising and analytics. We also use advertising and measurement tags from Google, Meta (Facebook) and Reddit — described in
section 6 — which set their own cookies and receive your IP address, the page you are viewing and basic device information.
These load only if you accept them. Until you do, Google Consent Mode is set to denied, so no advertising identifier or
analytics cookie is written, and the Meta and Reddit pixels are not loaded at all.
Your choice, and how to change it. The banner shown on your first visit asks before anything non-essential loads.
You can change your answer at any time using the Your Privacy Choices link in the footer of every page.
We also honour the Global Privacy Control browser signal
automatically: if your browser sends GPC, we treat it as an opt-out and never ask.
Always active (needed to run the service):
Stripe — payment processing. Stripe Privacy Policy
PayPal — payment processing. PayPal Privacy Policy
Google Fonts — fonts loaded from Google servers (your IP address is shared with Google as part of the font request).
Only after you accept tracking:
Google Ads / Google tag — measures which ads lead to a download or purchase. Receives your IP address, the page URL and device
information. Google Privacy Policy
Meta (Facebook) Pixel — measures ad performance and builds advertising audiences. Receives your IP address, the page URL and
device information. Meta Privacy Policy
Reddit Pixel — measures ad performance. Receives your IP address and the page URL, and — if you are signed in to our site — a
hashed form of your email address and your account identifier. Reddit Privacy Policy
Under California law, allowing these companies to receive your information for advertising counts as sharing personal information for
cross-context behavioural advertising. Declining, or sending a Global Privacy Control signal, stops it.
You have the right to:
We retain your account information for as long as your account is active. If you delete your account, we remove your personal data within 30 days. Payment records are retained for 7 years as required by financial regulations.
This service is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this policy occasionally. We will notify registered users by email of any material changes. The current version is always available at this URL.
Questions about this policy? Contact us:
Email: support@donlinestore.com
Website: www.donlinestore.com
This policy was written to be readable. If anything is unclear, please contact us.