Privacy policy
Last updated: September 26, 2026
General
This policy describes what data Nextlist (nextlist.shop, the "Service") collects when you use the site, what it is used for, how and where it is stored, and who it may be shared with. By using the Service — placing an order, signing in with Google or Telegram, or browsing the catalog — you agree to this policy.
What we collect
We collect only what is needed to process and deliver an order, run your account, and support you: your email address — when checking out as a guest or signing in with Google; profile data from Google or Telegram when you sign in with them — name, photo, account id, and, if you sign in with Google, your email address (the Telegram login widget never technically passes an email address to any site); order details — product, face value, payment status, date; technical information — IP address and browser data in server logs, needed to guard against fraud and to rate-limit requests. We never ask for third-party passwords, card numbers, or government ID details.
Cookies
The Service uses a small number of technical cookies: nx_locale and nx_currency remember your chosen display language and currency (about a year); nx_user is your account sign-in session, if you signed in with Google or Telegram; nx_access is a short-lived session for looking up an order by number and email without an account; nx_oauth_state is a 10-minute technical cookie that protects the Google sign-in flow itself from request forgery. None of these store a password or card number in plain form — session cookies hold only a signed or encrypted identifier that means nothing without the key on our server. Your shopping cart is never sent anywhere — it is stored only in your browser (localStorage) until you check out.
What data is used for
Data is used to: process and deliver your order; sign you in and restore access to an order; respond to support requests; guard against fraud and abuse — for example, limiting how many times an order access code can be guessed; improve how the site works. We do not use your data to show personalized advertising and we do not sell it to third parties.
How and where data is stored
Order and account data is stored in a database hosted in the European Union. The site admin password is stored as an irreversible hash, never in plain form; a guest's order access code is likewise stored hashed — the site itself cannot technically "read" your code, only check it against what you enter. The connection to the site is protected by HTTPS encryption throughout.
Who data is shared with
We share data only where the Service genuinely needs to: with the payment provider, to process your payment (it sees and holds your card details, not us); with our hosting and database providers, as technical subcontractors who keep the site running; with Google and Telegram, only as part of the sign-in flow you yourself started with them; with a government authority, on a lawful, substantiated request. We do not share or sell data to advertising networks or analytics services unrelated to running the site.
How long data is kept
Order data is kept as long as needed to meet our obligations to you (delivery, support, handling a refund) and accounting/tax record-keeping requirements — typically longer than the order itself, due to statutory retention periods for financial records. Preference cookies are kept for up to a year, or until you delete them in your browser.
Your rights
You can ask us for a copy of your data, or to delete it, unless we are required to keep it by law or for accounting purposes — contact support with your request. Records of completed orders may be kept longer than a deletion request due to statutory requirements for financial records; in that case we delete what we can and explain what remains and why.
Security
We apply reasonable technical safeguards: encrypted connections, hashed passwords and access codes, and rate-limiting on sign-in and code-guessing attempts. No site can guarantee absolute security for data sent over the internet, and we are not responsible for third-party access to data through no fault of ours — for example, if your own email or Google account is compromised.
Changes to this policy
We may update this policy — for example, as new features are added to the site. The date of the last update is shown at the top of the page. Continuing to use the Service after changes are published means you accept the updated version.
Contact
For questions about this policy and your data, contact support — details are listed at /contacts and /support.