Privacy policy

1. The rule this page is built on

If we do not need it to prepare and burn your packet, we do not ask for it.

That is written into the design of the database, not just into this page. Every field on the order form had to survive the question "what breaks if we drop this?" The ones that survived are listed below.

One thing belongs here rather than buried in section 12. Beyond what you type in, a few timestamps are recorded for you: when you submitted the form, when we sent you each email, and when your tracking link was opened. None of that is needed to deliver anything. It exists so that if someone ever disputes the payment on your order, we can show we did the work. There is not a name in it, and it is deleted sooner than the order is. The detail is in section 12.

2. Every field, and why it exists

The system also generates an order number, a random key for your tracking link, a timestamp and an order status. You do not enter those.

There is one further set of records you neither enter nor see: when you submitted the form, when we sent you each email, and when your tracking link was opened. They exist so that, if a payment is ever disputed, we can show that we actually delivered. What is in them, and how long they last, is in section 12.

3. What we deliberately do not ask for

Identity card or passport number, phone number. Neither, because neither is needed to deliver.

Your address. Not asked for: nothing is written from it, and delivery does not need it.

One item needs correcting here rather than quietly changing. This page used to say we asked for no date of birth. Since 6 September 2026, when we went with what the family shop actually writes on the bags, that is no longer true:

• Date of birth — asked only for the 冤親債主 packet, because that is the only one of the four with a date written on it. The ancestor, all-beings and pet packets still never ask.

It is explained on the form itself, at the point of asking, rather than only here. The rule behind them is unchanged: nothing is collected because it might come in handy — if it does not go on the bag, we do not ask.

If anyone asks you for an ID number or a phone number in our name, treat it as a warning sign.

4. What we use it for

• Replying to you with a price and a date
• Writing the packet and arranging the burning
• Photographing it, putting the photographs on your tracking page, emailing you
• If a payment is ever disputed, showing that we delivered — the “delivery evidence” row in section 12

That is the complete list. We do not sell it, trade it, build advertising audiences from it, or profile you — the payment dispute described in section 5 is the one exception.

Anniversary reminders are not available yet, and for now we do not collect anything for them. Before they open, we will change this policy first, setting out what they are for, how long the data is kept, and how you choose for yourself whether to have them; every reminder will then carry an unsubscribe link.

If you ticked the reminder box on an earlier order: we have never sent one. To cancel it, one email is enough, with no reason needed.

5. Who actually reads it

Two people: the one running this website, and our sister at the shop in Hong Kong who writes the packets.

Whoever writes the packet has to see the name. There is no way around that — it is what the service is.

The shop also physically holds a written packet with that name on it until it is burned. After burning, the physical copy no longer exists.

There is one situation in which someone else sees part of your order. If the payment on it is ever disputed, we hand the delivery evidence described in section 12 — the order number, when you ordered and when you opened the link, which emails we sent — together with your email address, to whoever adjudicates that dispute at the payment platform (PayPal today). It is how we show the work was done.

Apart from the services listed in section 9 that store our data and send our email, that is the only case where we hand your data to anyone. It happens one order at a time, by hand, once — not down a standing pipe. The name of your dead and the proof photographs are not part of it.

6. Your data is read in Hong Kong

Two separate points, often confused.

People: the packets are written at the shop in Hong Kong and burned at a burner in Hong Kong, so what you submit will be read by people in Hong Kong. If you are ordering from Canada, Australia, the UK or the US, that is a cross-border transfer of your data, and it is unavoidable — it is the service.

Machines: the site and database run on Cloudflare's global network, so your data may be stored on or pass through servers outside Hong Kong.

To be specific about the part we control: order records live in a Cloudflare D1 database, and we asked for it to be created in the Asia-Pacific region (apac). So the primary copy sits in Asia-Pacific rather than in Europe or North America.

“Created in Asia-Pacific” is not the same as “never leaves Asia-Pacific”, and we are not going to blur the two. Cloudflare is a global network: your browser connects to whichever of their locations is nearest you, and how they replicate and move data internally is documented by them, not by us.

7. Batch photographs: a real privacy trade-off

Because offerings are burned together, the batch photograph — the one taken at the shop or in front of the furnace, with every packet in it — may show other customers' packets, including the writing on them. There is no video, so this is the only image where it can happen, but one image is enough to matter.

The reverse holds too: yours may appear in photographs other customers receive. We are not going to pretend this does not happen.

So there is a step between the camera and your inbox: before the batch photograph goes to anyone, the writing on every seal in it is blurred by hand — yours included. One photograph serves the whole batch, so it is not only other people’s names that get covered. Not a camera angle, not a soft background — blurred in an image editor before the photograph goes anywhere. You can still tell each one is a red-and-yellow seal strip, but no word or number on it can be read.

And the honest limit of that: a person does it, so a person can miss one. Dozens of packets, small handwriting, awkward angles. If you can read a name in a photograph we sent you, tell us — we will replace your copy and go back through the others from that batch. The copy on the tracking page can be replaced; but the burned notice has already emailed the photographs as attachments (see section 9), and a copy that has reached a mailbox cannot be recalled.

There is also a way to take us out of the equation entirely: use a form of address rather than a full name — "my late father", or a collective family form. Both photographs still do their job, and the batch shot carries no full name to begin with, so nothing depends on our masking being perfect. A pet packet needs some name to be written at all, but a nickname or an initial works just as well if you would rather the full one stayed out of shot.

8. Information about people who have died

Whether data about the dead counts as personal data differs between jurisdictions, and we are not going to pretend to settle that here.

Our practice is to treat it as sensitive either way — collected, stored and deletable on the same terms as a living customer's data.

9. Third parties we use

Why the burned notice carries the photographs: some email apps do not load images from the web by default, so without attachments you might open the email and see nothing.

The cost, stated plainly: once sent, the attachments are your mailbox’s own copy. When we delete ours at twelve months, we cannot delete the one in your mailbox; how Resend keeps the emails it has sent is governed by their own policy. Your email provider (Gmail, for example) may also load the images in the email through its own servers.

If you would rather a full name never reached your mailbox, the approach at the end of section 7 works here too: use a form of address instead. It does not work for the 冤親債主 packet — that bag has to carry your name and date of birth, and both will be in the close-up photograph.

That is the whole list. No Google Analytics, no advertising pixels, no session recording, no heatmaps and no cross-site tracking. Alongside Cloudflare Web Analytics, selected public pages count daily page openings, clicks on service/order/WhatsApp links, form starts and submit attempts. Our own counters store only a fixed page label, event type, Hong Kong date and total. They do not store form contents, IP addresses, device identifiers, order numbers or tracking links, or send these events to another analytics service. Counts are not unique people and cannot reconstruct an individual browsing path. The only per-order record we keep is the delivery evidence described in section 12.

Instagram deserves a plain warning, because it is the one route out of this policy. A DM is governed by Meta's terms, not by this page, and we cannot delete Meta's copy of it.

So for the sensitive things — a full name, an anniversary date — the order form or email is the safer route. Sending an order number by DM to ask about progress is minor, but it does tie your Instagram account to your order, and that link is on Meta's side, not ours.

We would rather not point you to Instagram at all. There is now a published email address and a WhatsApp number (see section 15), and both are better routes. Instagram stays listed only because some people find us there first.

The new-order email sent to the shop deliberately carries no personal data at all — only an order number, packet type, quantity and time. Email passes through third-party mailboxes, gets forwarded and sits on phones; once personal data is in there, it cannot be pulled back.

10. Your tracking link is a key

Your order page is reached through a long random string in the URL. Anyone holding that link can see the order — that is the price of not making you create an account.

Forward it to family freely — but if one order covers several people, the link shows every one of those names at once, so it is worth a thought about whether the person you are forwarding it to should see all of them. Do not post it publicly.

On our side we do three things: the page is marked not to be indexed by search engines, the link is not passed on to other sites if you click away from it, and browsers and intermediaries are told not to cache it.

One thing you should know: each time the link is opened — and each time either proof photograph on it loads — a line is written on our side: the time, the line your browser uses to introduce itself (its User-Agent), and a hash computed from the IP address, never the address itself. It has one purpose: if a payment is disputed, we can show the order actually reached you. How long it is kept, and why, is in section 12.

A related detail: paste the link into WhatsApp or Facebook and those apps fetch it themselves to build a preview card. That is not you opening it, and we do not count it as you — those lines are marked separately. We go by what the browser says about itself, so when that is unclear the line is marked “unknown” rather than counted as you.

11. Cookies and tracking

We set no tracking cookies of our own.

Our daily interaction counters use no cookies or localStorage. They send no events when Do Not Track or Global Privacy Control is enabled. Totals cover the latest 90 Hong Kong calendar days; expired rows are deleted when the next event arrives. Order-tracking, admin and private work pages do not load this interaction script.

Every page except the order-tracking page and our admin page loads a small Cloudflare Web Analytics script. According to Cloudflare's own description, it uses no cookies or localStorage and does not track people by IP address; to check, search Cloudflare's developer documentation for "Web Analytics". On our side we see totals only.

The only thing we ourselves store on your device is which language you chose — a browser localStorage entry called sps.lang. Clear it and we simply ask again.

The order form loads Cloudflare Turnstile to tell people from bots. It may place technical data in your browser; for what exactly, read Cloudflare's own documentation rather than our summary of it.

12. How long we keep things

The seven-year row is only the transaction. Order number, date, amount, packet type — the things an accountant needs. It does not include the name of your dead, the words you wrote, or the photographs. Those go at twelve months — our copy, that is; attachments already delivered to your mailbox are outside our reach.

If you would rather we deleted things sooner than twelve months, ask (section 13).

One more, described exactly because we can: the anti-abuse record made when you submit the form does not store your IP address itself, only a hash computed from it.

We would rather not oversell that. The range of possible IP addresses is small, so a hash of one should not be treated as fully anonymous. It is a layer of protection, not a guarantee.

Those rows are deleted once they are more than a day old. The clean-up runs when the next order arrives, so on a quiet day an old row sits there a little longer than a day.

Three things worth stating plainly about the delivery evidence.

• There is not a single name in it. Those tables hold the order number and nothing else that identifies anyone — not your name, not your email, not the name of your dead, no photographs. That is deliberate: a record built to win a dispute should not quietly become a second customer list.
• The IP is hashed there too, never stored raw. We do compare those hashes once, against each other: was the person who placed the order the same one who opened the tracking link? What gets stored is only that yes-or-no answer. In a dispute a conclusion is worth more than a string of digits — and it means we never hold the address itself.
  It is hashed differently from the anti-abuse record above, though, so those two cannot be matched against each other. The anonymous anti-abuse table does not become a “which IP belongs to which order” index because this exists.
• It is shorter-lived than the order itself. Order records and proof photographs last 12 months; this goes at 240 days. Once it can no longer serve its purpose, it should not still be here.

If a dispute does happen, the recipient address a payment platform asks for is read out of the order record at that moment — not copied into these tables in advance, day after day, against a dispute that will almost certainly never come.

Those five rows are everything. We keep no second, quieter copy “just in case”. (What the platform does with its own restore points is section 6’s answer — read Cloudflare’s documentation, not our summary of it.)

13. What you can ask us to do

• See what we hold about you
• Correct anything wrong — and if it has not been burned yet, correcting the record corrects the packet too
• Delete your data
• Take back the reminder consent (if you ticked it before) — one email is enough; reminders are not available yet, and any reminder we ever send will carry an unsubscribe link as well

Email us. No form to fill in, and no reason required.

Three honest limits. Something already burned cannot be unburned. The accounting record of the transaction stays for seven years (section 12) — but the personal parts attached to it, the names and the words and the photographs, are deleted all the same. And the photographs already emailed to you with the burned notice are your own copy, which we cannot delete.

14. Which law applies, and what if you are in the EU, UK or California

We are a Hong Kong business, subject to the Personal Data (Privacy) Ordinance, Cap. 486. Its principles run through this whole page: collect only what is necessary, say what it is for, do not repurpose it, keep it secure, and let people see and correct it.

You may also have rights under the law where you live — the GDPR, the UK GDPR, Californian privacy law, or others. We are not going to argue about jurisdiction with a grieving customer. Whoever you are and wherever you are, if you ask for access, correction or deletion, we will do it. The Californian right people ask about most — opting out of the sale or sharing of your data — has nothing to act on here. We sell nothing and share nothing. The service providers in section 9 that host our data and send our email (including the proof photographs in the burned notice) act only for us; apart from them, the one exception is the dispute case in section 5.

To read the Ordinance or to complain about a Hong Kong business, the regulator is the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk). The full text is on the Hong Kong e-Legislation site under Cap. 486.

We cite no section numbers here. A wrong citation is worse than none.

If you are in the EU or the UK: we operate from Hong Kong and we serve individuals worldwide. If you are in the EU or the UK you may have additional rights under the GDPR or the UK GDPR — access, correction, erasure, portability, objection — and you can exercise them through the same email address in section 15. No special form, no separate channel, and we will not send you round in a circle for asking.

15. Contact

Any privacy question, or to exercise anything in section 13, email shenposon@gmail.com. A person reads it, in Hong Kong hours.

The party responsible for your data — the data user, in the words of the Ordinance — is:

• Data user: Shen Po Son (神婆個仔), run by the owner personally; the packets are handled by his sister at the paper offering shop in Hong Kong that his mother opened
• WhatsApp / telephone: +852 6073 0264
• Reply hours: Monday to Sunday, 09:00–18:00 Hong Kong time (UTC+8), every day of the year
• Email: shenposon@gmail.com
• Business Registration number: not listed yet — it goes in this line as soon as we have it

For anything to do with your data, email is the route to use: it leaves both of us a record. WhatsApp reaches us too, but do not put a full name of someone who has died, or your order's tracking link, into it — for the same reason set out about Instagram in section 9.

What the service itself commits to is set out in the terms of service.