Privacy Policy

The short version

We collect what we need to send you your order and to keep proper business records. We do not sell your data and we do not share it for advertising. We use Google Analytics to understand how the store is used so we can keep improving it for our customers — visitors in the EU, EEA, UK and Switzerland are asked to opt in first; everyone else can opt out at any time from the footer.

What we collect

When you place an order, we collect and keep:

• your email address, and a phone number if you give one
• the shipping address, and the billing address if it differs
• what you ordered, what you paid, and when
• the card brand and last four digits of the card used, plus the payment processor’s reference for the transaction

While you are shopping, your basket is held against a random identifier stored in a cookie in your browser. That identifier is not linked to you unless and until you place an order.

Our servers keep ordinary technical logs — the pages requested, timestamps, and enough about the source of a request to stop abuse and rate-limit it.

What we do not collect

We never see or store your full card number, expiry date or security code. Those go directly to our payment processor, which is why the only card details on our systems are the brand and last four digits.

We use no advertising cookies, tracking pixels, or session recording. We do not ask for anything we do not need — no date of birth, no demographic profiling, no marketing questionnaires.

We set two kinds of cookie: the one holding your shopping basket, which the site cannot work without, and Google Analytics cookies, which measure how the store is used. You can turn analytics off from the footer at any time.

Analytics, and the choice you get

We use Google Analytics to understand how many people visit, where they arrive from, and which cards they look at. We use it for one reason: to keep improving the store and bring the best product we can to our customers. It is the only third-party service that sees your browsing here.

How that works depends on where you are, because the law differs. If you are visiting from the EU, the EEA, the UK or Switzerland, we ask first: until you accept, Google Analytics is not loaded at all — no script, no cookies, no data sent. Everywhere else, analytics runs by default so the measurements are meaningful, and you can opt out whenever you like.

Either way you are in control: "Do Not Sell or Share My Personal Information" in the footer turns Google Analytics off for your browser and keeps it off, and you can still use the whole site.

We run it in analytics-only mode: we do not enable its advertising features, we do not use it to build advertising profiles, and we have turned off sharing your data with Google for its own purposes. IP addresses are anonymised.

Cookies, in plain terms

Two kinds, no more:

• a strictly necessary cookie holding your shopping basket — set for everyone, because checkout cannot work without it
• Google Analytics cookies — set by default to measure how the store is used, and not set once you opt out from the footer

That is the entire list. No advertising cookies, and no third-party trackers beyond Google Analytics.

Your California privacy rights

If you are a California resident, the CCPA gives you the right to know what personal information we hold about you, to have it deleted, to correct it, and not to be discriminated against for exercising any of those rights.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. The "Do Not Sell or Share My Personal Information" link in the footer is there regardless, and turns off analytics.

To make any of these requests, email [email protected] — the same address as everything else. We will respond within the timeframe the law requires.

Why we hold it, and for how long

Order details are held to fulfil the order, to handle any return, and because tax and accounting rules require a business to keep records of what it sold and to whom. Those records are kept for as long as those rules require and then disposed of.

Basket identifiers expire on their own within weeks of last use. Technical logs are kept briefly and then rotate away.

Who else sees it

Only those who need to in order to complete your order:

• our payment processor, which handles the payment and holds the card details we never receive
• the postal carrier, which receives the delivery address and nothing else
• our email provider, which sends order confirmations and delivery updates
• Google Analytics, if you accepted it — it sees your browsing on the site, not your order details or payment

We do not sell, rent or trade personal information, and we do not share it with advertisers or data brokers. We will disclose information if the law genuinely requires it, and we will tell you if we are permitted to.

Marketing

Order confirmations and delivery updates are part of the transaction and are sent to everyone who orders. Anything promotional is opt-in, and every promotional message carries a way to stop receiving them that works immediately.

Your choices

Email [email protected] and we will, without charge:

• tell you what we hold about you and send you a copy
• correct anything that is wrong
• delete what we are not legally required to keep — completed order records generally have to stay, but we can remove you from everything else

You do not need an account to shop here, and you can check out as a guest.

Children

This shop is intended to be used by adults, and we do not knowingly collect information from children. Plenty of the cards are bought for children, which is a different thing — the account and the payment are the grown-up’s.

Security

Traffic to and from the site is encrypted. Administrative access requires a password and a second factor. Payment details never reach our systems in the first place, which removes the largest risk entirely rather than defending it.

Changes, and how to reach us

If this policy changes materially we will update it here with a new date, and if we ever add a new service that sees your data, this page will name it.

Write to us at 1715 Lundy Ave. Ste 192, San Jose, CA 95131, or email [email protected].