We are all cynical about the “fine print,” but it’s simple and customer-friendly on this website. Here are the highlights in plain English …
- All PainScience.com ebooks have a 100% lifetime money-back guarantee.
- The site is fully encrypted — all the pages, not just the ones that deal with sales.
- Payments are processed by Stripe, a highly regarded company (A+ BBB rating). Card info never touches my servers, and isn’t stored by Stripe.
- Customer contact information is used only for fraud prevention and customer service (locating past orders). There is no mailing list, not even an opt-in mailing list.
- There are no ads on PainScience.com whatsoever, and therefore no 3rd party tracking either, and I do not use “cookies” for anything.
Topics covered in more detail on this page …
- Who are you buying from? A quick e-commerce security primer
- Refund policy: 100% lifetime money-back guarantee
- Credit card information is encrypted in transit, I never see it, and it’s never stored
- Storage of contact information is highly secure
- What about social media? Will Google know that I was here? The website visitor tracking problem
Who are you buying from? A quick e-commerce security primer
Many consumers are understandably a little concerned about giving out their credit card info online. Fortunately, it’s very safe if you know who you are giving it to. Most online fraud involves con-artists who are pretending to be legit vendors: they take your money and disappear.
My name is Paul Ingraham, owner and publisher of PainScience.com, based in Vancouver, Canada. It’s a one-man shop and always has been. PainScience.com has been online since 2000 (as SaveYourself.ca for many years, then PainScience.com since late 2014). To verify my identity, see my domain name records. You can also Google my name and find lots of evidence of me out there, being who I am, part of a community of professionals. I have Twitter and Facebook accounts, where I often publicly interact with all kinds of colleagues and experts, as well as readers … all of which would be really hard for a con-artist to fake.
Refund policy: 100% lifetime money-back guarantee
Please feel free to request a refund at any time, even months after purchase. I refund automatically upon request, like a reflex. I haven’t got any interest in having unhappy customers, ever. If you don’t like the product, please allow me the opportunity to either address your concern or return your money. My refund rate is just under 1%, compared to the >8% return rate typical for retail. Most of those refunds are for customers who simply bought the wrong book hoping it would apply to them — and I have no problem with that. Why would I?
Credit card information is encrypted in transit, I never see it, and it’s never stored
All PainScience.com pages are encrypted (not just the store pages) and have been since 2014. All information sent between my server and your device gets converted into gibberish for the trip. Even if a bad guy intercepted it, there’s no way to read it. So if you submit credit card information to buy an ebook, for instance, your credit card number is encrypted.
But it gets better! No one can send credit card info to me, a lowly retailer—instead, it goes straight from your web browser to a sophisticated payment processor, Stripe, a highly regarded company (see A+ BBB rating in a new tab/window). Since card info is only ever handled by Stripe, my own security practices are a moot point (as far as sensitive payment is concerned).
And so it’s quite literally true that using my internet store is “safer than a bank machine.” (Although this is difficult to prove, it’s a reasonable statement.) The lion’s share of online theft of credit card information is actually low-tech: thieves just fool people into voluntarily sending them information. They usually don’t steal individual credit card numbers “in transit” as they fly through the Internet tubes … because that’s really hard. Hackers rarely try to crack encrypted card info. It’s just not worth their effort.
Payment information is nearly impossible to steal from individual secured transactions & all of these companies allow customers to challenge charges in any case.
Card numbers are also not stored by either PainScience.com or Stripe. I can’t do that because I never get them in the first place. Stripe could save card numbers in principle, and they do it for some kinds of transactions (subscriptions I believe)… but not for the simple kinds of sales I do.
When you make a purchase at my store, I ask for your personal contact information — name, physical address, email address. This is mainly an anti-fraud measure.1
Abusing that information by sharing it or selling it is unthinkable. It is completely safe from that kind of abuse. I will never share it or sell it. I never send unsolicited email to customers; I only use your email to send you a purchase confirmation email (or to respond to your inquiries, of course). I hate spam as much as you do! We all hate it together.
Storage of personal information is highly secure
My customer information (names, emails, addresses) is stored in two places: a database on PainScience.com, and another one on Stripe. Are those databases secure? Hardly a day goes by that we don’t hear about a huge data breach, due to sloppy security at yet another big company — hundreds of them now!
My own security is excellent: I run a tight ship, and a weird one.
Stripe is a huge, juicy target … but a famously technically competent one. Most security breaches happen at companies where security is neglected (often to a degree that makes experts cringe), Stripe is at the other end of the spectrum: lots of elite programmers there. Their data is about as locked down as the Pentagon’s. Possibly more.
Personal information is not publicly exposed (even thought it might look that way)
Occasionally a customer notices that their name is displayed on what appears to be a publicly accessible page (the account page, or the full-access version of a tutorial). Appearances are deceiving. Due to an invisible security system, only you can see “your” pages here, unless you share the full-access link with someone yourself: the link itself is a simple login, but it's not as simple as it looks). They are definitely not available to the general public, and malicious scraping/crawling software cannot get to them either.
For obvious reasons, I don’t publish any details about how that system works. Suffice it to say it lets me customers in and keeps everyone else out.
What about social media website visitor tracking? Will Facebook and Google know that I was here?
It is possible, yes — unfortunately website visitor tracking is a very sophisticated technology these days. But it is also entirely out of my hands. It is all about your own browsing practices, and even more about the way that company’s like Google and Facebook do business. While I share my readers' concerns about browsing privacy, this is a broad social and technological problem, and it is just not within my power to protect my site visitors from it.
Really the only thing I can do is not use social media buttons (such as the ubiquitous Facebook “like” button), and I don't, but it also doesn’t make much difference in practice.2 Their asbence from PainScience.com is mainly a principled boycott, especially in the case of Facebook: as of 2019, I really don’t like the company’s corporate behaviour. I just think they are jerks.
I do strongly recommend using software that blocks ads and trackers. I don’t know the options for Windows and Android, but on Apple’s platform, 1Blocker X and Ghostery are both excellent for this purpose.
- PS Copyright, Reprinting, and Translations for PainScience.com —
- PS Dammit, Jim, I’m Not a Doctor! — The inevitable medical disclaimer for PainScience.com, in which I try to say the predictable legal stuff with as much folksy charm as possible
- PS Help! — Answers to common questions asked by PainScience.com customers
- This is changing, Stripe no longer requires it, and in the future it probably won’t be necessary for fraud prevention, but for now I think it’s still a good policy. BACK TO TEXT
- In theory, social media buttons (Facebook “liking”) facilitate tracking only for opted-in and logged-in users of those services, and are not a privacy problem for anyone else. Anyone can browse privately at any time if they choose to do so. If you do not want Facebook to know what web pages you are looking at, for instance, then you should make sure you are logged out of Facebook when you browse the web — although even that’s not a guarantee, unfortunately! They have other ways of tracking the browsing habits of their logged out users. So, in practice, these big tech companies can and do track anyone they possibly can in a thousand ways, and none of us can really do anything to stop them. BACK TO TEXT