Privacy & community
Who operates Cambags
The public operator name for this website is Cambags. Use our contact form for privacy questions and requests. You can also email admin@cambags.com.
Accounts and community contributions
We store your email address, display name, a one-way password hash, verification and account-status information, account creation date, saved favourites, and records used for sign-in, email verification and password resets. We use these to operate and protect your account. Your email address and password hash are not displayed publicly.
If you choose Continue with Google, Google confirms your identity and shares only your name, email address, whether Google has verified that address, and an account identifier that lets us recognise you next time. We use these to create or sign in to your Cambags account; your Google name becomes your display name for a new account. We do not receive your Google password, contacts, or any other Google data, and we do not post anything to Google. If your Google email matches an existing Cambags account, the two are linked. You can remove Cambags's access at any time in your Google account settings, and still sign in by setting a password with “Forgot your password?”.
Reviews include your author name, text, equipment and camera details, ratings, photographs, dates and moderation status. Approved reviews and their author names, ratings and approved photographs are public. Reports about reviews and administrator action records support moderation and abuse prevention; they are not public.
Contact messages and privacy requests
The contact form stores your name, email address, subject, message, submission date, email-delivery status and whether an administrator has marked the enquiry resolved. Messages are available in the private administrator inbox and may also be emailed to the configured site administrator. We use these details to handle and respond to your enquiry.
To request access to or a copy of your data, a correction, account deletion, or removal of personal information in archive content, use the contact form with the subject "Privacy request". Include the account email address and relevant page links, but never send your password, sign-in links or unnecessary identity documents. A message alone does not prove account ownership: an administrator will verify your identity and the scope of the request before releasing data or deleting an account. Requests are handled manually, not by an automatic deletion service. You can also ask about objections or restrictions on use of your data and any rights that apply where you live.
Essential cookies and browser storage
The essential cambags_session cookie keeps you signed in and is set for seven days. Signing out removes that session. If you continue with Google, an essential cambags_google_state cookie protects that sign-in from forgery for up to ten minutes and is removed when you return. Verification and password-reset links expire after one hour; expiration is not a guarantee that the underlying record has been erased.
Signed-out favourites are saved in this browser's local storage under cambags-favourites. On sign-in they are sent to your account; the browser list is cleared after a successful merge. Comparison selections use cambags-comparison in this browser. The camera bag visualiser keeps your last bag and packed layout under cbv-state-v1 in this browser; a copied visualiser link contains that layout but nothing else about you. You can clear these using the site controls or your browser's site-data settings. Account deletion cannot clear data on your devices.
Security and bot protection
We use rate limits to help prevent spam and account abuse. These records contain counters and expiry times keyed by an email address, account ID or, where the server is configured to trust its proxy, an IP address. Without that proxy configuration, a shared local or unknown value may be used instead. Limits have short operational windows, generally fifteen minutes or one hour; expired limit records are cleared when further rate-limit checks run, not by a guaranteed timed erasure job.
Cloudflare Turnstile protects sign-in, registration and account-email requests. Your browser connects to Cloudflare, which processes technical information such as IP address and browser signals to assess whether a request is automated. Our server sends the challenge response and, when available, your IP address to Cloudflare for verification. The contact form instead uses a hidden spam trap and per-IP rate limits. See Cloudflare's privacy policy.
Anonymous traffic analytics
When enabled, Cloudflare Web Analytics provides aggregate information such as visits, page views, referring websites, approximate country, browser, device type and page performance. It is configured without analytics cookies and Cloudflare does not provide us with individual visitor profiles. Cloudflare processes technical request and browser information to produce these statistics; the results are not linked to your Cambags account. See Cloudflare's privacy policy.
Hosting and email services
Our hosting service processes the website's database, uploaded files and technical requests. Hosting and network services may keep their own security or access logs. Hosting provider: OVHcloud.
When email delivery is configured, an email provider processes recipient addresses, account verification or reset messages, and contact notifications. Email provider: 123 Reg Professional Email. Provider locations, international transfers and provider retention depend on the services selected; this notice does not assert that data stays in any particular country.
Amazon links and optional advertising
Amazon shopping links are outbound links and may include an affiliate tag, so Cambags may earn a commission. Product pages choose the Amazon store from your approximate country, which our server looks up from your IP address each time the page is requested (visitors in the UK and Ireland see Amazon UK, everyone else sees Amazon US). The country is used only to choose the link and is not stored. Clicking a link sends you to Amazon, where Amazon receives the request and applies its own privacy and cookie policies. Our links do not include your Cambags account email or account ID. IP Geolocation by DB-IP.
When enabled, Google AdSense Auto Ads loads only on the public catalogue and individual bag pages, not on account, administrator, authentication, review-submission or contact pages. Google and its partners may process IP addresses, device information, cookies and related signals to deliver and measure ads. See how Google uses information from partner sites. Where consent is required, including for visitors in the UK, European Economic Area and Switzerland, Google's certified consent message asks for your choice before personalised advertising cookies are used. You can change or withdraw that choice at any time using the Privacy and cookie settings link in the site footer.
Retention and deletion
Accounts, contributions, favourites, contact messages and moderation records persist until they are removed through site tools or administrator handling. Marking a contact message resolved does not delete it. There is no general automatic retention schedule for these records. We do not promise a fixed deletion period for backups, mailboxes or provider logs.
After verification, administrators can export account-linked data and delete an account, its sessions and account tokens, favourites, owned non-archive reviews and associated uploads, related reports, matching contact messages and linked audit records. Ambiguous ownership needs separate review so that another person's content or the historical catalogue is not wrongly deleted. References in other people's text, email copies, caches, exports and backups may require separate cleanup. A private database backup is taken before manual account deletion and itself contains personal data. Restoring a backup requires reapplying completed deletion requests before the site is reopened.
Your photographs and reviews
Upload only photographs you own or have permission to share. You retain ownership and grant Cambags permission to display your submitted content with your review. New uploads are resized and re-encoded to remove embedded metadata; archive photographs may still contain metadata. Describe your own experience and disclose free products or commercial relationships. Do not post spam, personal attacks, unlawful content or private information about other people. Guest and member reviews and edits are moderated before publication; guest reviews cannot be edited or managed through an account after submission. Photographs removed from a review, and the photographs of a deleted review, are permanently deleted straight away. Report a published review when it needs moderator attention.
The archive
Historical listings, reviews and photographs were restored from the October 2018 Cambags backup. Archive author names and original publication dates are preserved; old login credentials and private account details were not imported. Archive content is not automatically linked to a new account with the same display name. Please identify the specific page when requesting a correction or removal. Product specifications reflect the information available at the time and may no longer be current.