Privacy policy.

1. Information we collect

We collect the following categories when you use the relevant feature. Ordering information is collected when checkout is available; simply visiting does not require a purchase or account.

We do not ask for government identifiers, biometric data, precise geolocation, health information, or sensitive characteristics. Please do not send those details, passwords, or payment credentials in our forms. If you voluntarily include sensitive information in a message, we use it only as necessary to handle that message or as legally required.

2. How we use information

We use the information above to provide and administer monthly subscriptions; authorize payments; calculate charges and applicable taxes; fulfill and track shipments; handle cancellations, returns, refunds, and disputes; answer customer and privacy requests; maintain business and compliance records; secure the store; and investigate fraud or technical problems. We limit collection to information reasonably needed for these purposes and do not use it for materially unrelated purposes without any notice and consent required by law.

We do not use personal information for automated profiling that produces legal or similarly significant decisions. We do not operate a marketing mailing list through this storefront or offer financial incentives in exchange for personal information.

3. Who receives information

We disclose information as necessary to these categories of recipients:

• Payments and subscriptions: Stripe processes checkout, billing, fraud prevention, and the customer portal. Stripe may act independently for some activities and optional services such as Link. Its own collection, cookies, and uses are described in Stripe’s privacy policy.
• Hosting and security: OpenAI Sites and its infrastructure providers, including Cloudflare, host the website, store operational records and product assets, and provide security and request logs. See OpenAI’s privacy policy and Cloudflare’s privacy policy for their own services.
• Inquiry notifications: when email forwarding is enabled, Resend and our business mailbox provider process contact messages and privacy requests to notify our team and support replies. Our notification destination is kept private on the storefront.
• Fulfillment: the carriers and shipping label services used for your shipment receive the contact, address, and shipment information needed to deliver it. A carrier may handle information under its own policy.
• Professional and legal recipients: advisers, auditors, insurers, authorities, or other parties when reasonably necessary to comply with law, protect rights or safety, or resolve a dispute.
• Business transactions: a successor or prospective buyer in a merger, acquisition, or asset transfer, subject to applicable confidentiality, notice, and privacy obligations.

These disclosures serve the purposes in section 2. We do not give customer information to other businesses for their own direct marketing. Service providers receive access appropriate to their role and applicable contractual restrictions; an independently operated service’s own activities are governed by its notice.

4. Cookies and privacy choices

Our storefront does not add advertising pixels, third-party merchant analytics, or advertising cookies. Hosting, security, sign-in, and payment providers may use cookies or similar technologies for their services. Stripe’s hosted pages and optional features may have separate cookie settings and notices. You can manage cookies in your browser, but blocking necessary cookies may affect payments or sign-in.

Do not sell or share my personal information: we do not sell personal information for money or other valuable consideration, share it for cross-context behavioral advertising, or process it for targeted advertising. These activities are disabled for everyone; no opt-out is needed to turn them off. This is also how we honor Global Privacy Control and other legally recognized universal opt-out signals: the covered processing remains off, regardless of whether a signal is present. Visit Your privacy choices to record a preference or ask a question without creating an account.

We do not separately change store behavior in response to legacy “Do Not Track” signals. We do not track visitors across unrelated websites for advertising. Independent services you visit, including optional payment services, may have their own practices; review their notices and controls.

5. Retention and security

We retain each category only as reasonably necessary for its stated purposes and applicable obligations. Factors include whether a subscription is active; fulfillment, return and dispute needs; accounting, tax and legal recordkeeping; the time needed to investigate abuse; and documentation of privacy requests and appeals. Records subject to legal holds may be kept longer. When no longer needed, information is deleted or de-identified, subject to lawful retention and normal backup replacement cycles. This policy does not promise immediate deletion from every backup.

We use safeguards appropriate to the information, including restricted administrator access and Stripe-hosted payment collection. No transmission or storage method is completely secure. We respond to security incidents and provide notices where required by law.

6. Your U.S. privacy rights

Depending on your state, the business’s statutory coverage, the information, and applicable exceptions, you may have rights to:

• Confirm processing and access personal information, including categories, sources, purposes, recipients, or specific pieces of information.
• Receive a portable copy in a usable format and, where available, information about specific third parties receiving personal data.
• Correct inaccuracies and request deletion, including information obtained from other sources where the law provides.
• Opt out of sales, sharing for cross-context behavioral advertising, targeted advertising, and certain profiling or automated decisions.
• Limit certain uses or disclosures of sensitive information, withdraw consent where processing depends on consent, and request information, explanation, correction, or review of consequential profiling where applicable.
• Appeal a refusal and exercise rights without unlawful discrimination or retaliation.

We accept privacy requests from residents of every U.S. state. The statutory rights and exemptions that apply are determined by law; this nationwide request channel does not narrow any rights.

California disclosures

The collection table and sections 2–5 describe our categories, sources, purposes, recipients, and retention criteria, including the categories collected or disclosed for business purposes during the preceding 12 months to the extent the relevant store features were used. We have not sold or shared personal information for cross-context behavioral advertising during that period, and do not knowingly sell or share information of consumers under 16. We do not use sensitive information to infer characteristics or for purposes that would require a right-to-limit mechanism under the CCPA. California residents may exercise applicable rights to know, access, correct, delete, opt out, limit, and receive nondiscriminatory treatment. We do not disclose personal information to third parties for their own direct marketing under California’s Shine the Light law.

Other state rights

The rights above include applicable rights under other state consumer privacy laws, including rights to specific third-party information in states such as Oregon and Minnesota and applicable rights to challenge certain profiling. Nevada residents may use the same form to submit a verified request to opt out of a sale under Nevada law; we do not engage in such sales.

7. Requests and appeals

Use our privacy request form for access, correction, deletion, portability, opt-outs, sensitive-information requests, or an appeal. It is our designated online privacy request address. No store account is required. Provide an email for our response and only enough detail to locate the relevant information. An order reference is optional. Please save the confirmation reference shown after submission.

For requests requiring verification, we may match details to existing records or ask for limited additional information through the reply email. We do not require you to upload identity documents through the public form. We verify only as needed, and do not require identity verification for an opt-out except to the extent permitted by law. An authorized agent may submit a request using the same form; identify the request as an agent request. Where permitted, we may seek proof of authorization and verification from the consumer. Parents or legal guardians may exercise applicable rights for a child.

We aim to respond within 45 calendar days, or sooner when required, and acknowledge requests within any shorter required period. If a lawful extension is necessary, we will notify you within the initial response period and explain why. Requests are free as required by law; any permitted fee or refusal for excessive or unfounded requests will be explained before a fee is charged. We explain any denial and applicable exceptions, including records we must retain by law.

Appeals: select “Appeal a privacy decision” on the same form and include the request reference or decision you want reviewed. We aim to provide a written appeal decision within 45 days, or any shorter required deadline, with reasons. Any extension will follow the applicable law. If an appeal is denied, we will explain how to contact the relevant state regulator. You may also contact your state attorney general; the National Association of Attorneys General directory lists state offices. California residents may also contact the California Privacy Protection Agency.

A privacy request does not itself cancel a subscription or reverse a payment. Use Manage subscription to stop future renewals or Contact for an order or refund question.

8. Children, location, and policy changes

The store is intended for adult purchasers and businesses, not children under 13. We do not knowingly collect children’s personal information. If you believe a child provided information, use the privacy request form so we can investigate and delete it or take other action required by law.

We currently serve U.S. delivery addresses. We and our providers may process information in the United States and other locations where they operate, subject to applicable protections.

We review this policy at least annually and update the date when it changes. Material changes will receive additional notice or consent when legally required, before any use for which that notice or consent is required. You can contact us about this policy through the privacy request form.