Detailed guides to painful problems, treatments & more

Security, Privacy, and Refund Policies

The “fine print” page for, with some extra details on ecommerce security

We are all cynical about the “fine print,” but it’s simple and customer-friendly on this website. Here are the highlights in plain English …

Topics covered in more detail on this page …

Who are you buying from? A quick e-commerce security primer

Many consumers are understandably a little concerned about giving out their credit card info online. Fortunately, it’s very safe if you know who you are giving it to. Most online fraud involves con-artists who are pretending to be legit vendors: they take your money and disappear.

And so the biggest rule of e-commerce security is to trust the seller, not so much the technology. Of course, you can never know for sure, but most honest businesses go out of their way to be identifiable and easy to contact.

My name is Paul Ingraham, owner and publisher of, based in Vancouver, Canada. It’s a one-man shop and always has been. has been online since 2000 (as for many years, then since late 2014). To verify my identity, see my domain name records. You can also Google my name and find lots of evidence of me out there, being who I am, part of a community of professionals. I have Twitter and Facebook accounts, where I often publicly interact with all kinds of colleagues and experts, as well as readers … all of which would be really hard for a con-artist to fake.

Paul Ingraham
, Publisher
Vancouver, Canada


Refund policy: 100% lifetime money-back guarantee

Please feel free to request a refund at any time, even months after purchase. I refund automatically upon request, like a reflex. I haven’t got any interest in having unhappy customers, ever. If you don’t like the product, please allow me the opportunity to either address your concern or return your money. My refund rate is just under 1%, compared to the >8% return rate typical for retail. Most of those refunds are for customers who simply bought the wrong book hoping it would apply to them — and I have no problem with that. Why would I?

Credit card information is encrypted in transit, I never see it, and it’s never stored

All pages are encrypted (not just the store pages) and have been since 2014. All information sent between my server and your device gets converted into gibberish for the trip. Even if a bad guy intercepted it, there’s no way to read it. So if you submit credit card information to buy an ebook, for instance, your credit card number is encrypted.

But it gets better! No one can send credit card info to me, a lowly retailer—instead, it goes straight from your web browser to a sophisticated payment processor, Stripe, a highly regarded company (see A+ BBB rating in a new tab/window). Since card info is only ever handled by Stripe, my own security practices are a moot point (as far as sensitive payment is concerned).

Powered By Stripe

And so it’s quite literally true that using my internet store is “safer than a bank machine.” (Although this is difficult to prove, it’s a reasonable statement.) The lion’s share of online theft of credit card information is actually low-tech: thieves just fool people into voluntarily sending them information. They usually don’t steal individual credit card numbers “in transit” as they fly through the Internet tubes … because that’s really hard. Hackers rarely try to crack encrypted card info. It’s just not worth their effort.

Payment information is nearly impossible to steal from individual secured transactions & all of these companies allow customers to challenge charges in any case.

Card numbers are also not stored by either or Stripe. I can’t do that because I never get them in the first place. Stripe could save card numbers in principle, and they do it for some kinds of transactions (subscriptions I believe)… but not for the simple kinds of sales I do.

Privacy policy: your contact information will never be used to contact you

When you make a purchase at my store, I ask for your address only as an anti-fraud measure. The only data about you stored on PainSci is your email address.

Abusing that information by sharing it or selling it is unthinkable. It is completely safe from that kind of abuse. I never send unsolicited email to customers; I only use your email to send you a purchase confirmation email (or to respond to your inquiries, of course). I hate spam as much as you do! We all hate it together.

Storage of personal information is highly secure

My customer information (emails and postal codes) is stored in two places: a database on, and another one on Stripe. Are those databases secure? Hardly a day goes by that we don’t hear about a huge data breach, due to sloppy security at yet another big company — hundreds of them now!

My own security is excellent: I run a tight ship, and a weird one. I’m a mildly paranoid, fastidious dork. I am the guy who tries to talk people into using a password manager. Not only do I place a high priority on security for my business, everything about is completely custom (“security through obscurity”). So is a small, hard, and non-standard target: it would be a tedious and a poor investment for a hacker to try to break in!

Stripe is a huge, juicy target … but a famously technically competent one. Most security breaches happen at companies where security is neglected (often to a degree that makes experts cringe), Stripe is at the other end of the spectrum: lots of elite programmers there. Their data is about as locked down as the Pentagon’s. Possibly more.

What about social media website visitor tracking? Will Facebook and Google know that I was here?

It is possible, yes — unfortunately website visitor tracking is a very sophisticated technology these days. But it is also entirely out of my hands. It is all about your own browsing practices, and even more about the way that company’s like Google and Facebook do business. While I share my readers' concerns about browsing privacy, this is a broad social and technological problem, and it is just not within my power to protect my site visitors from it.

Really the only thing I can do is not use social media buttons (such as the ubiquitous Facebook “like” button), and I don't, but it also doesn’t make much difference in practice.1 Their asbence from is mainly a principled boycott, especially in the case of Facebook: as of 2019, I really don’t like the company’s corporate behaviour. I just think they are jerks.

I do strongly recommend using software that blocks ads and trackers. I don’t know the options for Windows and Android, but on Apple’s platform, 1Blocker X and Ghostery are both excellent for this purpose.



  1. In theory, social media buttons (Facebook “liking”) facilitate tracking only for opted-in and logged-in users of those services, and are not a privacy problem for anyone else. Anyone can browse privately at any time if they choose to do so. If you do not want Facebook to know what web pages you are looking at, for instance, then you should make sure you are logged out of Facebook when you browse the web — although even that’s not a guarantee, unfortunately! They have other ways of tracking the browsing habits of their logged out users. So, in practice, these big tech companies can and do track anyone they possibly can in a thousand ways, and none of us can really do anything to stop them.