Privacy policy

We only collect what we need to make, ship and support your order.

• When you order: your email, the ship-to name and address (plus company and phone if you add them), what you ordered, any gift note, any promo code, and whether you asked to join our newsletter. We also keep the order totals, tax, shipping choice and tracking number.
• Customer record: your name and email, how many orders you've placed, what you've spent in total, and the dates of your first and latest order.
• Office and bulk inquiries: your name, email, organization, phone, the professions you're shopping for, quantity, date needed and your message.
• Contact messages: your name, email, subject and message.
• Newsletter: your email, whether you're pending, subscribed or unsubscribed, where you signed up, and when you confirmed or unsubscribed.

We never see or store your card number. Payment details go straight to Stripe on its secure checkout page.

• To take payment, pack your box, buy a shipping label and send it to the right place.
• To email your order confirmation and tracking link, and to answer your questions.
• To reply to office inquiries and contact messages.
• To send the newsletter, but only if you asked for it.
• To keep the books and handle sales tax, and to prevent fraud and spam.

We don't sell your personal information, and we don't share it for targeted advertising. We share it only with the services that help us run the shop, and only what each one needs:

• Stripe processes payments, and may calculate sales tax. It handles your card details under its own privacy policy.
• Shippo and the carrier you pick (such as USPS or UPS) get your ship-to name, address, phone and email to quote rates, create the label and deliver the box.
• SendGrid delivers our order emails and the newsletter.
• Cloudflare Turnstile checks that our forms are filled in by a person, not a bot.
• Railway hosts our website and the database where order and customer records are kept.

We may also share information if the law requires it, or to protect our customers or the shop from fraud or harm.

• No advertising or tracking cookies. We don't use ad networks or cross-site trackers.
• Your cart is saved in your own browser (localStorage) so it's still there when you come back. It holds only product names and quantities, and it never leaves your device until you check out. Clearing your browser data removes it.
• Stripe and Cloudflare may use their own cookies or device signals on the payment page and form checks, for security and fraud prevention.
• Analytics: we count page views ourselves, without cookies or anything stored in your browser. Each view sends only the page path and, on the first page of your visit, the site that referred you. We keep daily totals per page and referring site, and we don't store your IP address or any device or browser details. If your browser sends Do Not Track or Global Privacy Control, we don't count your visit at all.

• Order emails (confirmation and tracking) are part of your purchase, so they're sent whether or not you join the newsletter.
• If you sign up for the newsletter on our website, we email you a link first, and you're only added once you confirm. If you tick the newsletter box at checkout, you're added with the email on your order.
• Every newsletter has an unsubscribe link, and supporting email apps show a one-click unsubscribe button. You can also just email us.

We keep order records for as long as we need them for customer service, accounting and tax law, which can be several years. Inquiries and messages are kept while they're useful for following up. If you unsubscribe, we keep your email on file marked as unsubscribed so we don't email you again by mistake.

Our systems use encrypted connections, access is limited to our password-protected back-office accounts, and we don't write your email, address or payment details into our system logs. No system is perfectly secure, but we take care with what you trust us with.

Our shop is meant for adults buying gifts. We don't knowingly collect information from children under 13. If you think a child has given us information, tell us through our privacy request form and we'll delete it.

You can ask us to tell you what personal information we have about you, correct it, or delete it. Depending on where you live, you may have more rights: California and several other states give residents extra rights over their personal information, such as the right to know, delete, correct, and opt out of its sale or sharing (we don't sell or share it). We won't treat you differently for using any of these rights.

To make a request, use our privacy request form with the email address you used with us, and tell us what you'd like. We may ask a question or two to confirm it's really you, and we'll reply within 45 days. We may need to keep some records, like completed orders, where the law requires it.

If we change how we handle your information, we'll update this page and its effective date. For a big change, we'll give notice on the site or by email before it takes effect.

Questions about your privacy? Send them through our privacy request form.