Privacy Policy

1. The short version

We collect what we need to ship you a card and nothing else. We don't run ad trackers, we don't build advertising profiles, and we have never sold customer data — we don't intend to start.

We never see or store your card number. Card details go straight from your browser to Square, our payment processor.

2. What we collect

When you place an order, you give us the details needed to charge and deliver it:

• Your email address, and your phone number if you choose to provide one
• Your shipping name and postal address
• What you ordered, what it cost, and whether you added Buyer's Protection
• A payment reference and receipt link from Square — not your card number, expiry, or security code

3. What we don't collect

We don't ask for a date of birth, a government ID, or a social media profile. We don't have customer accounts, so there's no password of yours for us to store or leak.

Your full card number, expiry date, and CVV are entered into a secure field hosted by Square inside our checkout page. That data goes directly to Square. It never reaches our servers and never enters our database or logs.

4. Cookies and local storage

We use no advertising cookies, no analytics cookies, and no third-party trackers. What the site does store in your browser is functional only:

• Your shopping cart, kept in your browser's local storage so it survives a refresh. It stays on your device and is only sent to us when you ask for a price quote or check out.
• An admin session cookie, set only if the shop owner logs in to the private admin area. It never appears for customers.
• Cookies Square may set inside its own payment field to process your payment securely and detect fraud, governed by Square's privacy policy.

5. How we use your information

We use what we collect to take payment for your order, ship it to you, send you a receipt and tracking, answer your support emails, handle a Buyer's Protection or return claim, and keep the business's own tax and accounting records.

We do not use your information for behavioural advertising, and we don't send marketing email unless you ask us to.

6. Who we share it with

We share your information only with the services that make an order possible, and only the parts each one needs:

• Square, to process your payment and issue refunds
• Our shipping carrier, which receives the name and address on the label
• Our hosting and database providers, which store the site and your order record on our behalf
• Law enforcement or a regulator, where we're legally required to respond

7. How long we keep it

We keep order records — including the shipping address and what was in the order — for as long as we need them for accounting, tax, and warranty purposes, which is generally seven years. Support emails are kept while they're useful for resolving your issue and then deleted.

Your cart isn't stored on our servers at all. Clearing your browser data removes it.

8. Your choices and rights

You can ask us what we hold about you, ask for a copy of it, ask us to correct something wrong, or ask us to delete it. Email us and we'll respond within 30 days. Note that we can't delete an order record we're required to keep for tax purposes, and we'll tell you if that's the reason.

Depending on where you live, you may have specific statutory rights — for example under the California Consumer Privacy Act. We extend the same access, correction, and deletion process to everyone who asks, regardless of state, and we will never charge you or degrade your service for exercising them.

9. Security

The site is served over HTTPS, payment data is isolated inside Square's hosted fields, and access to the admin area is restricted and password-protected. Order data is stored in a managed database that is not publicly reachable.

No system is perfectly secure, and we won't pretend otherwise. If a breach ever affects your personal information, we'll tell you promptly and directly.

10. Children

The shop isn't directed at children under 13, and we don't knowingly collect their personal information. If you believe a child has given us personal information, email us and we'll delete it.

11. Changes to this policy

If we change this policy, we'll update the effective date at the top of this page. Material changes to how we handle information already collected will be described here rather than made quietly.

12. Contact

Privacy questions, or a request to access or delete your data, go to strawhatpokesupport@gmail.com.