Privacy, plainly

The short version

OFFSHEET has no accounts, no sign-up, no advertising trackers and no tracking cookies. Your cart and preferences stay in your own browser (plus one small preference cookie, below). Our servers keep only the minimum technical logs needed to run and protect the site.

Who is responsible

OFFSHEET (offsheet.shop) is the controller of the limited data described here.

Stored in your browser

Your cart, chosen shopping agent, currency, shipping country and packing options are saved in your browser's local storage so the site remembers them between visits. This data never leaves your device unless you share a cart link yourself.

When you choose who you're shopping for (men, women or everything), we save that choice in a first-party cookie called os_for for up to a year. It's sent to our server only so we can show the matching homepage and results; it holds nothing but that one word and isn't used for tracking or advertising.

All of this is strictly functional, which is why there's no cookie banner. Clear your browser's site data to delete it, or switch your choice any time from the menu.

What our servers process

• Request logs from our hosting provider (IP address, browser user-agent, page requested, time), used for security, abuse prevention and debugging. They're kept for the host's standard log period and not used to profile you.
• Outbound clicks: when you press Buy we record the agent, the item and the referring page (not who you are) to understand which links are used.
• Analytics: cookieless, aggregated statistics from GoatCounter, which runs on our own server: pages viewed, referring site, country, device type and which Buy buttons are used. IP addresses aren't stored. No cross-site tracking or advertising identifiers.
• Rate limiting: when you request an AI on-model preview we briefly keep a hashed count per network address in memory to prevent abuse.

Legal basis (GDPR / UK GDPR): our legitimate interest in operating a secure, working website.

Service providers

• Amazon Web Services (AWS): hosting and file storage (servers in the United States).
• OpenAI (and optionally Google Gemini): generate AI on-model previews. Only the seller's public product photo and a text prompt are sent, never anything about you.
• Exchange-rate provider: daily currency rates (no user data).

These providers may process data in the United States and other countries; they use standard contractual safeguards for international transfers.

Third-party sites

Buy, store and sign-up links take you to independent shopping agents, sellers and other sites. Some links contain our referral code. Their own privacy policies apply once you're there.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California's CCPA/CPRA), you can ask to access, correct or delete personal data, or object to its processing. Because we have no accounts, we usually hold nothing that identifies you; contact us and we'll help with any request. We don't sell or share personal information for advertising.

Children

The site isn't directed at children under 16 and we don't knowingly collect their data.

Changes

We'll update this page if anything changes, with a new “last updated” date.