Legal

Privacy policy

Effective date: June 2026

What we collect

When you place an order, we collect your name, email address, shipping address, and phone number. We do not store your payment card details — all card data is processed and held by Stripe, Inc. Your email may be used to send order confirmations and shipping notifications via Resend.

If you create an account, we store your email and a hashed credential. We do not store plaintext passwords.

Analytics and session data

We use PostHog for anonymous product analytics (page views, funnel steps, feature usage). PostHog data is self-hosted and does not include personally identifiable information unless you are signed in. We use Sentry for error monitoring; error reports may include your URL and browser information.

We use Cloudflare Turnstile for bot protection. Turnstile operates without tracking cookies.

Cookies

We set two first-party httpOnly cookies: one to persist your shopping cart across sessions, one to maintain your login state if you create an account. Neither is used for advertising. We do not use third-party tracking cookies.

How we use your data

We use your contact and shipping information to fulfill your order and send transactional emails (order confirmation, shipping, refund). We do not sell your data to third parties. We do not use your data for targeted advertising.

Third-party processors

We share data with the following processors to fulfill orders:

  • Stripe — payment processing and tax calculation
  • Shippo — carrier rate quotes and shipping labels
  • Resend — transactional email delivery
  • Supabase / Railway — database and application hosting
  • Vercel — storefront hosting

Data retention

Order data is retained for as long as required by applicable tax and accounting regulations (typically 7 years in the US). Account data is retained until you request deletion.

Your rights

You may request access to, correction of, or deletion of your personal data by emailing us. We will respond within 30 days. If you are in the EU or UK, you have additional rights under GDPR; note that we do not actively market to EU/UK customers and our operations are US/Canada-focused.

Changes to this policy

We may update this policy as our practices change. Material changes will be noted with a new effective date.