Privacy
What we collect, and what we do not
Written in plain language, and specific to this site rather than copied from a template. If something here is unclear, ask us and we will explain it.
Last reviewed 24 Aug 2026
The short version
- We ask for a name, a phone number and an address because a courier cannot deliver a toy without them.
- We do not sell your details, and we do not share them for anybody else’s advertising.
- We do not ask you to make an account, and we never store card details — there is nothing to store.
- We count page visits in a way that is not tied to who you are: a random id, a page path, how long the page was open and how far down it you read.
- You can ask us what we hold about you, and ask us to delete it.
When you place an order
To deliver a toy and to take payment at the door, we store:
- Your name, phone number, and a second number if you gave one.
- The delivery address, including any landmark or instruction you added.
- An email address, only if you chose to give one — it is optional.
- What you ordered, what it cost, and the delivery estimate at the time.
- A gift message, if you asked for one on the card.
We use these to pack the order, hand it to the courier, confirm it with you on WhatsApp, and deal with a return if there is one. Order records are kept for as long as tax and accounting rules require, because an order is also a receipt.
Couriers are given your name, address and phone number, because that is the parcel label. They are not given your email, your order history or anything else.
Cookies this site sets
No advertising cookies of our own, and no third-party cookie is set by anything we control unless it is listed further down. Most of these are marked httpOnly, which means no script on the page — ours or anybody else’s — can read them.
| Cookie | What it is for | How long |
|---|---|---|
kh_cart | What is in your basket — product ids and quantities only. No prices and no names, because the server works those out fresh on every page load. | 30 days |
kh_cart_count | How many items are in the basket, so the number on the cart icon can be drawn without asking the server. The only cookie here that the page itself can read. | 30 days |
kh_addr | Delivery addresses you have saved, so you do not retype them. Stored in the cookie itself rather than on our servers, which means they stay in your browser. | 180 days |
kh_orders | The order numbers this browser has placed. It is what lets your order page open for you and refuse everybody else. | 30 days |
kh_vid / kh_sid | A random visitor id and a session id, used to count visits and tell a returning visitor from a new one. Neither is linked to your name, phone number or address. | Visitor id until you clear your browser; session id 30 minutes of inactivity |
kh_theme / kh_brand_css | Whether you chose the light or dark theme, so the page does not flash on the next visit. | Until you clear your browser |
How we measure the site
When you open a page, your browser sends us one small message as you leave it. It carries the page path, how long the page was actually visible, how far down you scrolled, a random visitor id, a session id, and the type of device — phone, tablet or desktop. It does not carry your name, your number, your address, or anything you typed.
We shorten your IP address before storing anything, so it identifies a network and a city rather than a household. Detailed rows are deleted after 90 days; what survives is day-level totals — how many people looked at a page, how long they stayed on average — which are not about individuals at all.
We currently load no third-party analytics or advertising scripts at all. If that changes — a Google or Meta tag to measure advertising — this page will say so before it happens.
Children
We sell toys to adults. This shop is not aimed at children, we do not knowingly collect anything about a child, and there is nothing on the site for a child to sign up to.
When you tell us an age — in a filter, or in the gift finder — we use it to suggest suitable toys and to understand which age ranges are popular. It is not attached to a name, and we do not ask whose birthday it is.
If you send us a photo of your child for a review or to be shown on the site, we strip the location data out of the file before it is stored, and we only publish it if you asked us to. Ask us to remove it at any point and we will.
What you can ask us for
Message us on WhatsApp at +92 333 600 6563 or email shani6006563@gmail.com and you can ask us to:
- Tell you what we hold about you, and where it came from.
- Correct anything that is wrong.
- Delete your details, except what we must keep as a record of a completed order.
- Stop messaging you about anything other than an order you have placed.
You can also clear the cookies above from your browser at any time. The basket and saved addresses go with them, because that is where they live.
Keeping it safe
The site is served over an encrypted connection only. Order and address details are handled by our own servers rather than passed to third parties, access is limited to the people who pack and support orders, and we do not put personal details into logs, error reports or analytics.
We do not take card payments, so no card number, expiry date or CVV ever reaches this site. If that changes we will use a licensed payment provider and the card details will go to them, not to us.
Changes to this policy
When it changes, the date at the top changes with it. If a change affects what we collect or who we share it with, we will say so plainly rather than quietly editing a line.
Khilona Toys (Pvt) Ltd is the data controller for this site. Our address is on the contact page.