Privacy policy

Last updated November 2026.

What we collect

Your bag. We set one first-party cookie (ilike_cart) holding a random token so your bag survives a reload. It contains no personal data and expires after 60 days.
Your order. When you pay, Stripe collects your email address, delivery address and payment details. Stripe sends us the email, the delivery address and a payment reference — never your card number.
Your messages. If you email us, we keep the thread so we can help you and reference it later.
Your account, if you create one. We store your email address, your first and last name, an optional phone number, the delivery address you save and whether you opted into marketing email. Your password is never stored as text — only a one-way scrypt hash of it — and signing in sets one first-party cookie (ilike_customer) that holds a random session token lasting up to 30 days. An account is optional: you can order as a guest and look your order up with its number instead.

What we do with it

We use your details to take payment, pack and deliver your order, answer your questions, and keep the accounting records the law requires. We do not sell your data, and we do not run third-party advertising trackers on this site.

If you have an account we also use it to show you your own order history and to fill in checkout. We only send marketing email when you asked for it, and every message has a one-click unsubscribe.

Who else sees it

Stripe processes payments and holds the payment record.
Our shipping carriers receive the name and delivery address needed to deliver your parcel.
Our hosting provider stores the site and the order records on our behalf.

How long we keep it

Order and payment records are kept for as long as tax and accounting rules require. Cart cookies expire after 60 days. Support emails are kept while they're useful and then deleted.

An account stays until you ask us to close it. Closing it removes your profile, your saved address and your sign-in sessions; order records stay because we have to keep them, but they stop being linked to a sign-in you can use.

Your choices

Email hello@ilikecandy.com to ask for a copy of what we hold about you, to correct it, or to have it deleted where we aren't required to keep it. You can clear the cart cookie at any time in your browser settings — your bag will simply start empty.

If you have an account you can change your name, phone number, delivery address and marketing preference yourself on your account page, change your password there, and sign out at any time. Ask us and we'll close the account entirely.