Legal
Privacy
Last updated 25 August 2026.
The responsible party for the purposes of POPIA is Nick Howarth, trading in his own name, who is also the information officer. Anything on this page can be raised with him directly at nick@townshiptales.com.
Physical address:
42 Laughton Avenue
Glenashley
KwaZulu-Natal
South Africa
The short version
Ordering a book means telling us who you are and where to post it, and that is kept so the parcel can be sent and the sale accounted for. There is no analytics on this site. There is one advertising tracker, Meta’s pixel, and it does not load unless you say yes.
What is collected, and why
| What | When | Why |
|---|---|---|
| Name, email address, phone number, delivery address | When you start a checkout | To post the book, to email you about it, and to keep a record of the sale. If a checkout is started but never paid for, we send one email — only ever one — to ask whether something went wrong |
| What you ordered and what it cost | When you start a checkout | To reconcile the payment and to know what to pack |
| Your IP address and browser user-agent | When you start a checkout | Fraud and abuse. It sits on the order row and is not used for anything else |
| PayFast’s payment id and its notification, kept verbatim | When the payment settles | So a disputed payment months later can be answered with a record rather than a shrug |
| Your name, email address and message | When you use the contact form | To answer you |
| Server request logs | Every request | Diagnosis. Request bodies are redacted before anything is written, so names and addresses do not reach the log |
Where it lives
Orders are kept in a SQLite database on a single server rented from DigitalOcean. The file is readable only by the process that serves this site, and its contents are shown only to a signed-in administrator over an encrypted connection. It is backed up nightly to the same machine, and those backups are kept for thirty nights.
Before this rebuild, orders were emailed to a third-party form relay before the payment was even taken. That is gone. Nothing about an order leaves this server except to the three services named below.
Who else sees it
| Who | What they get |
|---|---|
| PayFast (Payfast (Pty) Ltd, South Africa) | Your name, email address, phone number and the amount, so they can take the payment. Your card details are entered on their pages and never reach this site. |
| Resend (email delivery) | The emails this site sends you, and therefore your email address and what is in them. |
| Meta (Facebook) | Nothing at all unless you accepted the cookie notice. See below. |
| DigitalOcean | They host the server. They do not have a reason to read what is on it, and are not given one. |
Nothing is sold, rented, or handed to anyone for marketing. There is no mailing list on this site, so your address cannot be added to one.
Cookies and the Meta pixel
This site sets no cookie of its own for ordinary visitors. The only cookie it ever sets is the session cookie for the administrator’s login, and you will never see it.
Meta’s advertising pixel is the one third-party thing here. It reports that a browser visited, and it sets cookies belonging to Facebook. It is not in the page: it is loaded by a script on this site only after somebody has pressed Accept on the cookie notice. Decline, and no request is made to Facebook at all — not the script, not the tracking image, nothing.
Your choice is remembered in your browser’s local storage for a year, so you are not asked on every page. You can change it at any time:
What is kept in your browser
| Key | What it holds |
|---|---|
tt-cookie-choice | Whether you accepted the pixel, and when you decided. Expires after a year. |
tt-order-ref | Your last order reference, so the thank-you page can show it if PayFast returns you without one. |
tt-order-value | The amount of that order, for the same reason. |
tt-purchase-… | A note that a purchase has already been reported to Meta, so refreshing the thank-you page does not report it twice. |
All of these live in your browser and are readable only by this site. None of them is sent to the server.
The local-currency estimate
Overseas readers see roughly what an order comes to in their own money. Two things make that work, and both happen on the server:
- Your country is worked out from your IP address using a database stored on the server itself. Your address is not sent to anyone to do this.
- Exchange rates are fetched by the server every few hours and shared by everyone. Your browser does not call a rate service, and no request identifying you is made.
On the old site both of those were done by your browser, which meant every visitor’s address went to a third party. That no longer happens.
How long it is kept
- Orders and payment records — kept as long as the law requires business records to be kept, which in South Africa is five years, and then deleted.
- Contact form messages — kept as long as the conversation is useful, then deleted.
- Server logs — rotated by the host and not archived.
- Nightly backups — thirty nights, then deleted.
Your rights
Under POPIA you may ask us to:
- tell you what we hold about you;
- correct anything that is wrong;
- delete it, where we are not required to keep it as a business record;
- stop using it for anything you did not agree to.
Send any of these to Nick Howarth, the information officer, at nick@townshiptales.com, or through the contact form. We will answer within a reasonable time and at no charge.
If you are not satisfied with the answer, you have the right to complain to the Information Regulator of South Africa.
Children
This site sells a book about political violence and policing. It is not aimed at children and we do not knowingly collect anything from them.
Changes
If what the site does changes, this page changes with it, and the date at the top says when.