Offline Luxury Privacy Policy
Offline Luxury is a subscription. Once a month we post a physical artifact, a card, to your home address. To do that we need your address, and we hold it while you are a member and for a year after the last card is sent. Beyond that we ask for the month and day of your birthday and a tick in a box. Nothing else is asked of you. The site also sets five cookies it needs in order to work, and our host keeps ordinary server logs for a short time; both are described below.
This policy says what we collect, why, on what legal basis, who else handles it, where it goes, how long we keep it, and what you can ask us to do. It applies to https://offline-luxury.vercel.app and to the artifacts we send. It is written to meet the EU and UK GDPR and Japan's Act on the Protection of Personal Information (APPI), and to be plainly true for readers in the United States.
Effective 3 September 2026.
Who we are
Offline Luxury is run by Magnus LLC, a company incorporated in Japan and based in Tokyo. Magnus LLC decides what is collected and why. It is the controller under the GDPR and UK GDPR, and the personal information handling business operator under the APPI.
Magnus LLC, [postal address], Tokyo, Japan. Representative: Cameron Hurd.
For anything in this policy, including requests about your data and complaints, email cameron@magnus.fyi. That is our only contact point, and it is the contact point for complaints under the APPI. We have not appointed a data protection officer, and the law does not require us to. We have not appointed a representative in the EU or the UK.
What we collect
We collect little. The list below covers everything the site collects. Two further cases, email you send us and material you submit, are described after it.
We do not collect your name, your email address, or your phone number. A postal address can identify you or your household on its own, so we treat it as personal data. A birth month and day, held alongside an address, is personal data too.
If you email us, we receive your email address and what you write. We use them only to reply and to handle your request. If you later use the Submit page, we receive the material you send. See the section on material you submit.
- On the /receive form — your postal address: address line 1, address line 2, city, state or region, postal code, country.
- On the /receive form — your birth month and day. We do not ask for your birth year, and we do not hold one.
- On the /receive form — your tick in the consent box, confirming that you are 18 or older and that you agree to this policy and the terms.
- Automatically — five cookies, each needed for the site to work. They are named, with what each holds and how long it lasts, in the cookies section below.
- Automatically — aggregate page-view counts from Vercel Web Analytics. No cookies, and nothing that identifies you.
- Automatically — server logs, held by our host Vercel for a short period. Logs of this kind normally contain your IP address, the time of the request, and the page requested.
Why we use it, and on what basis
We use your address to post the artifacts to you, and to check once, at the moment you submit the form, that it is deliverable. We use your birth month and day to personalise the artifacts we send you. We use the technical data to run the site and keep it working, including the 59-second registration window and the 24-hour lockout.
Under the APPI, our purpose of use is: to post physical artifacts to you; to validate that your address is deliverable; and to operate and secure the site. We use your data for nothing else. If we ever wanted to use it for a new purpose, we would tell you first and, where the law requires it, ask for your consent again; see the section on changes to this policy.
We do not sell your personal data. We do not use it for advertising. We do not build a profile of you. We make no decision about you by automated means that has a legal or similarly significant effect on you. The address check is automated, but it looks only at whether the address you typed can receive post.
No law requires you to give us your address. Giving it is a condition of the arrangement, because the artifacts are physical: without an address we cannot send them, and if the form is not completed, registration cannot complete.
Our lawful basis under the GDPR and UK GDPR is set out below.
- Your address, and your birth month and day: your consent, given by ticking the box on the form (Article 6(1)(a)); and performance of the arrangement you asked for when you registered, that is, sending you the artifacts (Article 6(1)(b)).
- Cookies, server logs, and aggregate analytics: our legitimate interest in running the site as designed and keeping it secure (Article 6(1)(f)). The cookies are strictly necessary, so no separate consent is needed to set them. You can object to this use; see your rights below.
- Email you send us: our legitimate interest in replying to you (Article 6(1)(f)); where it is a request to exercise your rights, our legal obligation to handle it (Article 6(1)(c)).
- Material you submit: your consent, given by choosing to send it (Article 6(1)(a)).
Who receives it
We use a small number of providers. Each provider is bound by its own published privacy terms.
The postal services that carry an artifact see the address on the envelope. That is how post works.
Beyond the providers listed, we disclose personal data only if the law requires it, for example to a court or regulator with proper authority.
- Google LLC, United States — Address Validation API. When you submit the form, your address is sent to Google once, to check that it is deliverable. Only the address is sent, not your birth month or day. Google’s handling of that request is governed by the Google Maps Platform Terms of Service (https://cloud.google.com/maps-platform/terms) and the Google Privacy Policy (https://policies.google.com/privacy).
- Notion Labs, Inc., United States — storage. Your address and your birth month and day are stored in Notion, on servers in the United States.
- Vercel Inc., United States — hosting, edge network, and analytics. Vercel serves the site, holds the server logs, and produces the aggregate page-view counts.
- A printing and postal fulfilment provider — not yet selected. When we choose one, it will receive your postal address, with no name attached, so that it can send the artifacts. We will update this policy when that happens, and if the provider is outside Japan we will add it to the international transfers section.
International transfers
We are in Japan. Our current providers are in the United States. Wherever you live, your data crosses at least one border.
If you are in the EU or the UK: the European Commission and the UK government have each decided that Japan protects personal data adequately, so your data reaching us in Japan needs no extra safeguard. For the onward transfers to Google, Notion, and Vercel in the United States, we rely on the EU-US and UK-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses approved by the European Commission and the UK government. Email cameron@magnus.fyi if you want a copy of the safeguard.
If you are in Japan: the APPI requires us to tell you, before you register, that your personal data is provided to recipients in the United States — Google LLC, Notion Labs, Inc., and Vercel Inc. — and you consent to this by ticking the box on the form. About the United States: it has no single federal law that protects personal data across all businesses; protection comes from sector-specific federal laws, from the laws of some states, from each provider's contract with us, and from the provider's own security measures. Each of these providers publishes the measures it takes to protect personal data. Details are available from us on request. If the fulfilment provider we choose is outside Japan, we will tell you the same things about it.
If you are in the United States: Notion holds your address and birthday in the United States. Google, Notion, and Vercel are US companies. We read the data from Japan.
How long we keep it
Your address and your birth month and day: while you are receiving artifacts, and for 12 months after the last artifact is sent. Then we delete them. If you ask us to delete them sooner, we do.
Material you submit: for as long as we hold your address, unless you ask us to delete it sooner. Deleting it from our systems cannot recall artifacts that have already been printed and posted.
Cookies: ol_locked_until lasts for the 24-hour lockout. ol_deadline lasts up to 25 hours, ol_now two minutes, and ol_completed and ol_lang one year. What each cookie holds is set out in the cookies section below.
Server logs: held by Vercel for a short period, hours to a few days, then deleted.
Email you send us: as long as we need it to handle your request and to show that we did, and no longer than 12 months after your request is closed.
Your rights, and exactly how to use them
Wherever you live, you can ask us to do any of the things listed below. We treat everyone the same, whether or not the law where you live grants that particular right.
How to ask: email cameron@magnus.fyi and say which of these you want. Because we hold no name and no email address, we cannot find your record from your email alone. Include the postal address you registered, exactly as you entered it. That is how we find you. If we need to check that the request comes from the person at that address, we may ask you to confirm a detail you registered, such as your birth month and day, and no more than we need.
We reply within one month. If your request is complex we may take up to two months more, and we will tell you before the first month ends. We do not charge.
If you think we have got something wrong, you can complain. In the EU: to the data protection supervisory authority in the country where you live or work. In the UK: to the Information Commissioner's Office. In Japan: to the Personal Information Protection Commission (PPC). You do not have to contact us first, though we would rather you did.
- Access — tell you what we hold about you, and give you a copy.
- Correction — fix it if it is wrong or out of date. A wrong address means no artifact, so tell us.
- Deletion — remove it. Sends stop, because there is nowhere to send to. Artifacts already posted cannot be recalled.
- Restriction — hold it but stop using it, while a dispute or a check is resolved.
- Objection — stop a particular use. This includes any use based on our legitimate interests.
- Portability — give it to you, or to someone you name, in a common electronic format.
- Withdrawal of consent — at any time, by email. Future sends stop. It does not undo what happened while consent stood.
Cookies and analytics
The site sets five cookies. Each is strictly necessary — the site does not work as designed without it — so no consent is required to set them. None is used for tracking or advertising, and no other cookies or trackers are set.
The 59-second window and the 24-hour lockout are a deliberate part of the design of the site. They are not a security control. The cookies that run them hold nothing about you beyond a time.
Analytics: we use Vercel Web Analytics. It sets no cookies. It counts page views in aggregate — how many times a page was seen — and does not identify you, follow you to other sites, or serve advertising.
- ol_deadline — records when your 59-second registration window closes. Lifetime: up to 25 hours.
- ol_now — the server’s clock at the moment of the response, so the countdown stays accurate on a device whose own clock is wrong. Lifetime: 2 minutes.
- ol_locked_until — set if the window lapses. Records when your 24-hour lockout ends. It is HttpOnly, so scripts in the browser cannot read it. Lifetime: 24 hours.
- ol_completed — records that you have submitted the form. Lifetime: 1 year.
- ol_lang — remembers the language you chose for the site. Lifetime: 1 year.
Children
Offline Luxury is for adults. You must be 18 or older to register, and you confirm this by ticking the box on the form. We do not knowingly collect personal data from anyone under 18.
If we learn that a member is under 18, we stop sending artifacts and delete their address and birth month and day. If you believe someone under 18 has registered, email cameron@magnus.fyi with the postal address concerned.
Material you submit
After you have received your first card, you can send us material — photos, writing — through the Submit page. You do not have to.
What you send may contain personal data: yours, or other people's if they appear in it. Send material about other people only if you have their permission.
We hold it so that we can reproduce it in the artifacts and related material, under the licence you grant in the terms. You keep ownership. The rights and the retention rule in this policy apply to it, with one physical limit: we cannot recall an artifact that has already been printed and posted.
Security
The first protection is that your record holds little: an address, a birth month and day, and nothing else — no name, no email address, no phone number, no birth year. There is no contact detail in it to tie the address and birthday to you.
The site is served over HTTPS. The lockout cookie is HttpOnly. Your address and birthday sit in a Notion workspace; access to it is limited to Magnus LLC staff who handle fulfilment. Google, Notion, and Vercel each protect the data under their own security measures and their contracts with us.
No system is perfectly secure. If a breach affects your data and puts you at risk, we will tell you by post at your registered address, since that is the only contact we hold, and we will notify the relevant authority where the law requires it.
Changes to this policy
If we change this policy, we change the date at the top and publish the new version on the site. One change we already expect: naming the fulfilment provider once it is chosen.
If a change is significant — a new use of your data, or a new recipient — we announce it on the site before it takes effect. Where the law needs your consent again, we ask for it.
Contact
Magnus LLC, [postal address], Tokyo, Japan.
Email: cameron@magnus.fyi — for privacy requests, complaints, questions, and everything else.