Privacy policy for a site that stores almost nothing about you
This is a static website: the pages are built in advance and served as files. That architecture decides most of this policy, so it is short and specific rather than long and cautious. Where something does get recorded, it is named below.
What we hold, and what we do not
- Accounts
- None. There is no login, no profile, no saved list of favourite suppliers and no password to leak, because none of those features exist on this domain.
- Cookies
- We set none. No session cookie, no consent cookie, no advertising cookie. A response from this site carries no Set-Cookie header from our code.
- Browser storage
- The tools are local. If a tool remembers anything, such as a pasted album link or a drafted contact card, it keeps it in your browser’s localStorage so it survives a refresh. That data never leaves your device, we cannot read it, and clearing site data removes it.
- Analytics and pixels
- No ad pixels, no heatmaps, no embedded social widgets, no font or script requests to tracking domains. The hosting edge injects Cloudflare Web Analytics, a cookieless aggregate page counter; it is the only request that leaves this build, and it carries no identifier for you.
- Search boxes
- The filters and lookups on seller, category and tool pages run in your browser against data compiled into the page. Typing in them sends nothing anywhere.
- Inbound mail
- If you email the editorial address, we hold that thread in the mailbox until it is no longer useful, and reply if you asked for a reply. We do not add addresses to a marketing list; there is no list to add them to.
Hosting, logs and the one thing we cannot promise
The build is served as static assets from Cloudflare Workers. Requests for these files pass through their edge, so their platform sees what any web server sees: the address requested, a user agent, a referrer when your browser sends one, and an IP address. Retention and aggregation follow Cloudflare's default log handling for the Workers plan this site runs on; we do not receive, export or query a log of you individually, and we have no dashboard of visitor behaviour to look at.
Two headers on every page make that safer than the average directory. Referrer policy is set to
strict-origin-when-cross-origin, so a click out to a supplier sends only the origin rather than the full path you were
reading. Every outbound partner link opens with rel="sponsored nofollow noopener", which also stops the destination receiving
a reference to the window you came from.
What we cannot promise: that a site you click through to respects your settings. The moment you leave this domain their policy applies, and most storefronts and mirrors in this market run analytics we have not audited.
Your choices, children, and how we change this page
Requests about anything we hold go to editorial@yupoo.rest: access to a thread you sent us, correction of something wrong in it, or deletion. Because the site keeps no user records, a request usually means removing an email from an inbox, which we can do and confirm. If you would like the record of an audited storefront taken down rather than corrected, that is handled under the correction policy, and we decide it as an editorial question about a public page rather than a privacy one.
Where you are covered by a regime that treats an IP address as personal data, the hosting note above is the honest answer: an address is visible to the edge provider that serves these files, on their default terms, and we do not process it further.
Children. This index is written for adults who place wholesale orders, and it discusses commercial suppliers and trademarked goods. It is not directed at children and no feature is available to them, since there is nothing to sign up for. If a parent or school believes a child has emailed us, write to the same address and the thread will be deleted.
Changes. Material edits to this page get a dated line here rather than a silent rewrite, and the audit date at the top of the site tells you when the copy last changed. Continued use after an edit means you accept it; if you do not, the practical alternative is not to use the site, which requires no notice to us.
Privacy questions
Three that people reasonably ask before trusting an index with their click.
Do you sell or share visitor data?
There is no visitor data to sell. Nothing is profiled, aggregated from behaviour, or handed to an advertiser. The only outbound data flow is the one you cause: clicking a partner link puts your browser on their site with a ref parameter attached.
How do I ask you to delete something you hold about me?
Write to editorial@yupoo.rest and say what you sent and when. A correction thread you started is the only thing we would hold, and we will confirm removal. There is no database of you to purge, which is the point of building the site this way.
Does the partner site know I came from yupoo.rest?
Yes, that is the purpose of the link. The URL carries ref=yupoo.rest, so the destination records this domain as the source of the visit. If you would rather not be attributed, open the storefront directly instead of using the button, or strip the query string before you load the page.