This folder is where send.php writes what comes in.

  orders-YYYY-MM.csv    every order, one file per month. Open it in Excel
                        or Google Sheets.
  trapped-YYYY-MM.csv   submissions the spam traps stopped. Check it now and
                        then to make sure a real person has not been caught.
  mail-failures.log     written only when an order saved but the email did
                        not go out. An empty or missing file is good news.
  rate.json             counts recent submissions so one visitor cannot send
                        hundreds. Addresses are stored hashed, not in full.

KEEP THIS FOLDER PRIVATE

The .htaccess file beside this one blocks web access on Apache, which is what
most shared hosting runs. If your host uses nginx instead, .htaccess is
ignored, so do one of these two things:

  1. Move this folder above your web root and point $LOG_DIR in send.php at
     the new location. This is the better answer.
  2. Add a deny rule for /storage/ to your nginx site config.

Either way, after your site is live, type the address of one of the CSV files
into a browser. You want "403 Forbidden" or "404 Not Found". If the file
downloads, your customers' names and addresses are public and you should fix
it before doing anything else.

PERMISSIONS

PHP has to be able to write here. If nothing appears after a test order, set
the folder to 755, or 775 if your host needs it. send.php creates the folder
by itself if it is missing.
