Privacy Policy.

Last updated: May 2026.

Short version: we collect the minimum we need to ship your order and run the shop, we don’t sell anyone’s data, and you can ask us to delete what we have on you any time.

What we collect

• Order data. Your name, shipping address, billing address, email, phone (only if you give it), and what you bought. Required to fulfill the order.
• Payment data. Card details go directly to our payment processor (Stripe or PayPal) and are tokenized — we never see or store your full card number. We only see the last 4 digits and card brand for customer service.
• Site analytics. Google Analytics and Meta’s Pixel record which pages you viewed, where you came from, rough geographic location (city level, not address), and device type. This is aggregated; we don’t tie it to your name unless you’ve also bought something.
• Email subscribers. If you join our list we store your email and the date you subscribed. That’s it.
• Customer service correspondence. Emails and chat sessions are kept for up to 2 years so we can reference past orders if you write back.

What we don’t collect

• Social Security numbers, government IDs, or any equivalent — there is no scenario in which we’d ask
• Children’s data — our products and marketing are aimed at adult homeowners and we do not knowingly collect data from anyone under 16
• Health data, biometrics, precise location

Who we share with

• Carriers (UPS, USPS, DHL): name and shipping address only, to deliver your package
• Payment processors (Stripe, PayPal): the data needed to charge the card and run fraud checks
• Email platform (Klaviyo): email address and order history, used only to send transactional and marketing emails from us
• Analytics (Google, Meta): anonymized usage data — see the cookie notice that pops up the first time you visit
• Lawful requests: court orders or subpoenas we’re legally required to comply with

We do not sell customer data to anyone. We don’t share customer lists with third-party advertisers as “audiences.” We don’t license your information.

Cookies

We use three categories: essential cookies (cart, login session), analytics cookies (the ones mentioned above), and advertising cookies (Meta and Pinterest pixels). You can decline non-essential cookies via the banner that appears on your first visit, or in your browser settings any time after. Declining doesn’t break the site — only essential cookies are needed for checkout.

Your rights

Wherever you live, you can email [email protected] and request:

• A copy of everything we have on you
• A correction to any of it
• Deletion of everything except what we’re legally required to retain (e.g. invoices for tax purposes)
• Unsubscribe from marketing email (there’s also a one-click unsubscribe at the bottom of every campaign)

If you’re in California, the EU, or the UK, you have additional statutory rights under CCPA, GDPR, and UK GDPR respectively — most of which are covered by the bullet list above, plus the right to lodge a complaint with your local data authority if we don’t respond within 30 days.

Data retention

Order records: 7 years (for tax and warranty purposes). Email subscriber records: until you unsubscribe. Customer service: 2 years. Analytics data: 26 months at Google’s default. After those windows we delete or anonymize.

Security

The site runs on TLS 1.3, the database is encrypted at rest, and admin access is locked behind 2FA on every account that can read customer data. We’ve never had a breach. If we ever do, you’ll hear from us within 72 hours of confirmation.

Changes to this policy

If we make changes we’ll bump the date at the top and, for substantive changes, send an email to active customers.

Contact

Privacy questions, requests for your data, or anything else covered above: [email protected].