Privacy
Privacy policy
What you hand over here is unusually personal — a family member's name, the date they died, something you want said to them. So this page goes field by field: what we take, why, who reads it, and how to have it deleted.
1. The rule this page is built on
If we do not need it to carry out the offering, we do not ask for it.
That is written into the design of the database, not just into this page. Every field on the order form had to survive the question "what breaks if we drop this?" The ones that survived are listed below.
2. Every field, and why it exists
| Field | Required? | Why |
|---|---|---|
| Packet type | Yes | Which of the four to prepare |
| Quantity | Yes | How many to prepare |
| Your name | Yes | So a reply has someone to address, and because it is written on the packet as the sender. Whatever you go by is fine; it does not have to match a document. Chinese is best, English is fine |
| Your email | Yes | To tell you how to pay, send the tracking link, and deliver the photographs. Without it we cannot deliver anything |
| Your region | No | Time zone, so we do not reply at three in the morning your time. That is the whole reason we ask |
| Name or form of address of the person who died | Only for the ancestor packet | It gets written on the packet. The creditor and all-beings packets do not ask you for this at all |
| Your pet’s name | Only for the pet packet | It gets written on the packet. For that packet we do not ask for the animal’s breed, a photograph, or any dates |
| Whether the dead person was a man or a woman | Ancestor packet only | A packet holds one paper outfit and the shop stocks two, a man’s and a woman’s. Without this the packet cannot be made up. The other three never ask: the 冤親債主 and 十方眾生 packets get both sets, and the pet packet has no clothes in it at all |
| Ancestral home | No | The place the family reckons itself as being from — 廣東台山, say. It is written on the bag, on the top line under the name. Only offered on the ancestor packet; leaving it blank changes nothing else |
| Your date of birth (Gregorian) | 冤親債主 packet only | One packet out of four asks for this, because one packet out of four has a date written on it: the bag reads 陳大文冤親債主收 on the top line and 陳大文送 on the sender line, with the date alongside. That is how the packet identifies you when no dead person is named. The ancestor, all-beings and pet packets never ask for it and never store it |
| Your relationship to them | No | Used in the wording on the packet |
| Anniversary of death | No | Kept only if you fill it in and tick the reminder box yourself. The box is never ticked for you; leave it alone and no reminder record is created |
The system also generates an order number, a random key for your tracking link, a timestamp and an order status. You do not enter those.
3. What we deliberately do not ask for
Identity card or passport number, phone number. Neither, because neither is needed to deliver.
Your address. Not asked for: nothing is posted, and nothing is written from it.
One item needs correcting here rather than quietly changing. This page used to say we asked for no date of birth. Since 6 September 2026, when the owner settled the wording the shop actually puts on the bags, that is no longer true:
- Date of birth — asked only for the 冤親債主 packet, because that is the only one of the four with a date written on it. The ancestor, all-beings and pet packets still never ask.
It is explained on the form itself, at the point of asking, rather than only here. The rule behind them is unchanged: nothing is collected because it might come in handy — if it does not go on the bag, we do not ask.
If anyone asks you for an ID number or a phone number in our name, treat it as a warning sign.
There are also no accounts and no passwords. Your order is reached through one unique link — nobody should have to create an account to have an offering burned.
4. What we use it for
- Replying to you with a price and a date
- Writing the packet and arranging the burning
- Photographing it, putting the photographs on your tracking page, emailing you
- Only if you gave an anniversary date and ticked the reminder box yourself: one reminder, thirty days before the next anniversary
That is the complete list. We do not sell it, trade it, build advertising audiences from it, or profile you.
One honest caveat about that reminder: it does not run yet. We have never sent one, and the automatic sending is not built. So please do not rely on it to remember the date for you.
You can withdraw that consent at any time by email, with no reason needed. If reminders ever do start, every one will carry a one-click unsubscribe link.
5. Who actually reads it
Two people: the one running this website, and our sister at the shop in Hong Kong who writes the packets and burns them.
Whoever writes the packet has to see the name. There is no way around that — it is what the service is.
The shop also physically holds a written packet with that name on it until it is burned. After burning, the physical copy no longer exists.
6. Your data is read in Hong Kong
Two separate points, often confused.
People: the writing and burning happen in Hong Kong, so what you submit will be read by people in Hong Kong. If you are ordering from Canada, Australia, the UK or the US, that is a cross-border transfer of your data, and it is unavoidable — it is the service.
Machines: the site and database run on Cloudflare's global network, so your data may be stored on or pass through servers outside Hong Kong.
To be specific about the part we control: order records live in a Cloudflare D1 database, and we asked for it to be created in the Asia-Pacific region (apac). So the primary copy sits in Asia-Pacific rather than in Europe or North America.
“Created in Asia-Pacific” is not the same as “never leaves Asia-Pacific”, and we are not going to blur the two. Cloudflare is a global network: your browser connects to whichever of their locations is nearest you, and how they replicate and move data internally is documented by them, not by us.
7. Batch photographs: a real privacy trade-off
Because offerings are burned together, the batch photograph — the one taken at the shop or in front of the furnace, with every packet in it — may show other customers' packets, including the writing on them. There is no video, so this is the only image where it can happen, but one image is enough to matter.
The reverse holds too: yours may appear in photographs other customers receive. We are not going to pretend this does not happen.
So there is a step between the furnace and your inbox: every batch photograph is edited by hand to black out any name that is not from your order. Not a camera angle, not a blurred background — painted over in an image editor before the photograph goes anywhere. Once it is covered, it does not come back.
And the honest limit of that: a person does it, so a person can miss one. Dozens of packets, small handwriting, awkward angles. If you spot someone else's name showing in a photograph we sent you, tell us — we will replace your copy and go back through the others from that batch.
There is also a way to take us out of the equation entirely: use a form of address rather than a full name — "my late father", or a collective family form. Both photographs still do their job, and the batch shot carries no full name to begin with, so nothing depends on our masking being perfect.
8. Information about people who have died
Whether data about the dead counts as personal data differs between jurisdictions, and we are not going to pretend to settle that here.
Our practice is to treat it as sensitive either way — collected, stored and deletable on the same terms as a living customer's data.
9. Third parties we use
| Service | What it does | What it touches |
|---|---|---|
| Cloudflare | Website hosting, database, bot check on the order form (Turnstile), and the email that tells the shop a new order arrived | Site traffic and order records sit on their platform |
| Instagram (Meta) | We have an account there, and several places on this site invite you to message us — the order page, the tracking page, and the form if your browser blocks it | Anything you send in a DM, including an order number, sits with Meta |
| Stripe (not yet connected) | Card payments, when prices exist | Once connected, card details go straight to Stripe. We never see your full card number |
That is the whole list. No Google Analytics, no advertising pixels, no session recording, no heatmaps. You can confirm that part yourself by viewing the page source.
Instagram deserves a plain warning, because it is the one route out of this policy. A DM is governed by Meta's terms, not by this page, and we cannot delete Meta's copy of it.
So for the sensitive things — a full name, an anniversary date — the order form or email is the safer route. Sending an order number by DM to ask about progress is minor, but it does tie your Instagram account to your order, and that link is on Meta's side, not ours.
We would rather not point you to Instagram at all. Until there is a published customer email address (see section 15), it is the only way to reach us that does not depend on this website working.
The new-order email sent to the shop deliberately carries no personal data at all — only an order number, packet type, quantity and time. Email passes through third-party mailboxes, gets forwarded and sits on phones; once personal data is in there, it cannot be pulled back.
10. Your tracking link is a key
Your order page is reached through a long random string in the URL. Anyone holding that link can see the order — that is the price of not making you create an account.
Forward it to family freely. Do not post it publicly.
On our side we do three things: the page is marked not to be indexed by search engines, the link is not passed on to other sites if you click away from it, and browsers and intermediaries are told not to cache it.
11. Cookies and tracking
We set no tracking cookies of our own.
The only thing we store on your device is which language you chose — a browser localStorage entry called sps.lang. Clear it and we simply ask again.
The order form loads Cloudflare Turnstile to tell people from bots. It may place technical data in your browser; for what exactly, read Cloudflare's own documentation rather than our summary of it.
12. How long we keep things
| What | Kept for | Why that long |
|---|---|---|
| Order records (your name, email, the name or form of address, whether the dead person was a man or a woman, ancestral home, date of birth, address, the words you asked for) | 12 months | Long enough to come back with a question, short enough that sensitive data is not sitting here for years |
| Proof photographs (your packet, the batch shot) | 12 months | Same reason. After that the tracking page no longer has the images — save your own copy |
| Accounting record of the transaction | 7 years | Hong Kong tax rules require business records to be kept for a set period. This part we cannot delete on request |
| Anti-abuse record (hashed IP) | 1 day | It exists to stop bots, and it is useless after that |
The seven-year row is only the transaction. Order number, date, amount, packet type — the things an accountant needs. It does not include the name of your dead, the words you wrote, or the photographs. Those go at twelve months.
If you would rather we deleted things sooner than twelve months, ask (section 13).
One more, described exactly because we can: the anti-abuse record made when you submit the form does not store your IP address itself, only a hash computed from it.
We would rather not oversell that. The range of possible IP addresses is small, so a hash of one should not be treated as fully anonymous. It is a layer of protection, not a guarantee.
Those rows are deleted once they are more than a day old. The clean-up runs when the next order arrives, so on a quiet day an old row sits there a little longer than a day.
Those four rows are everything. There is no second, quieter copy kept “just in case”.
13. What you can ask us to do
- See what we hold about you
- Correct anything wrong — and if it has not been burned yet, correcting the record corrects the packet too
- Delete your data
- Take back the reminder consent — one email is enough, and any reminder we ever send will carry an unsubscribe link as well
Email us. No form to fill in, and no reason required.
Two honest limits. Something already burned cannot be unburned. And the accounting record of the transaction stays for seven years (section 12) — but the personal parts attached to it, the names and the words and the photographs, are deleted all the same.
14. Which law applies, and what if you are in the EU, UK or California
We are a Hong Kong business, subject to the Personal Data (Privacy) Ordinance, Cap. 486. Its principles run through this whole page: collect only what is necessary, say what it is for, do not repurpose it, keep it secure, and let people see and correct it.
You may also have rights under the law where you live — the GDPR, the UK GDPR, Californian privacy law, or others. We are not going to argue about jurisdiction with a grieving customer. Whoever you are and wherever you are, if you ask for access, correction or deletion, we will do it.
To read the Ordinance or to complain about a Hong Kong business, the regulator is the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk). The full text is on the Hong Kong e-Legislation site under Cap. 486.
We cite no section numbers here. A wrong citation is worse than none.
If you are in the EU or the UK: we operate from Hong Kong and we serve individuals worldwide. If you are in the EU or the UK you may have additional rights under the GDPR or the UK GDPR — access, correction, erasure, portability, objection — and you can exercise them through the same email address in section 15. No special form, no separate channel, and we will not send you round in a circle for asking.
15. Contact
Any privacy question, or to exercise anything in section 13, email shenposon@gmail.com. A person reads it, in Hong Kong hours.
The party responsible for your data — the data user, in the words of the Ordinance — is:
- Data user: Shen Po Son (神婆個仔), run by the owner personally; the packets are handled by his sister’s paper offering shop in Hong Kong
- WhatsApp / telephone: +852 6073 0264
- Reply hours: Monday to Sunday, 09:00–18:00 Hong Kong time (UTC+8), every day of the year
- Email: shenposon@gmail.com
- Business Registration number: not listed yet — it goes in this line as soon as we have it
For anything to do with your data, email is the route to use: it leaves both of us a record. WhatsApp reaches us too, but do not put a full name of someone who has died, or your order's tracking link, into it — for the same reason set out about Instagram in section 9.
What the service itself commits to is set out in the terms of service.