Privacy

What we collect

When you buy something: your name, email address, shipping address and phone number. The phone number is required by the carrier and the printer; it is not used for marketing.

When you join the email list or ask for a place: your email address, the place you asked for, and the page you were on when you joined. What our email tool is told after that is listed under Cookies and tracking.

When you place a custom order, ask for a bulk quote, or apply for wholesale or a fundraiser: what you typed into that form (what you asked for, your name, your email address and phone number if you gave them, and the name and town of your shop or group) and the page you were on. We use it to answer you and, for a custom order, to make and ship it. It is not added to the email list. A custom order is paid on Stripe’s checkout like any other order, so everything above about buying something applies to it too.

When you simply browse: your browser stores your bag on your own device. If you allow Analytics, it also remembers recently viewed designs. Clearing your browser data clears them. What our advertising and analytics tools are told about a visit is listed under Cookies and tracking.

Card details

We never see them. Payment is handled entirely by Stripe on Stripe’s own checkout page; your card number does not touch this website or any system we control. Stripe’s privacy notice governs what they do with it.

Who else sees your information

Your name and shipping address go to our printing and fulfillment partners in the United States, because somebody has to ship the package. They receive what is needed to make and ship your order and nothing more.

Our website and order records are hosted in the United States by our hosting and database providers. We do not exchange personal information for money. If you allow marketing tracking, we share information with the advertising and email services described below. Some privacy laws call advertising-related disclosures a sale or sharing of personal information, even when no money changes hands. You can turn off optional marketing tracking in Cookie settings.

Email

We email you about your own order (confirmation, shipping and delivery) because you bought something. That is not marketing and you cannot unsubscribe from it without canceling the order. One of those emails, the confirmation of a custom order, is sent for us by Klaviyo and has an unsubscribe link like all of Klaviyo’s mail; using it stops Klaviyo’s emails to you and changes nothing about your order.

Marketing email only goes to people who asked for it. Every one of those has an unsubscribe link, and using it takes effect immediately.

Stripe’s checkout page may show a box under the email field that reads “Keep me updated with news and personalized offers.” If you check it and then leave without paying, Stripe gives us your email address and a link back to the same bag, and we send you one email with that link. We use that address for nothing else unless you join the email list. If you don’t tick the box, we never learn the address of a checkout you leave.

Cookies and tracking

Your choices. Optional analytics and marketing tracking are off until you choose. Accept optional turns on both categories; Reject optional leaves both off; Settings lets you choose them separately. You can reopen Cookie settings in the footer of every page to change or withdraw your choice. Shopping and checkout work either way. Ignoring the banner or closing Settings does not grant permission.

Essential storage. We keep your bag, checkout and security information, your privacy choices and any discount or referral code you ask to use. A first-party preference cookie remembers your choice for up to 180 days, and an HttpOnly cookie holds a random browser token so our server can honor that choice during checkout. We store the token’s hash, the choices, the version of the notice and when the choice was saved; this receipt does not contain your email, IP address or browsing history. We ask again after the choice expires or if the consent version changes. Your choice applies to this browser; other browsers and devices have their own settings.

Analytics, if you allow it. Google Analytics helps us understand page views, products opened and added to the bag, checkout starts, purchases and form submissions. Form reports identify which form was sent, never what you typed. Our Google Analytics is connected to our own Google Ads and Merchant Center accounts, so Google Analytics loads only when you allow both Analytics and Marketing. With Analytics alone, only our first-party experiments and recently viewed list run; no Google tracking tag loads. Advertising personalization stays off in every case. Our page experiments assign and remember a version and count views, bag additions and orders. Experiment results are totals, without names or emails. Analytics permission also enables the recently viewed list stored on your own device.

Marketing, if you allow it. Google Ads measures which ads led to purchases. Meta’s pixel (Facebook and Instagram) receives page and product activity, bag additions and checkout starts, along with IP and browser information. Meta’s automatic settings can also collect page details and hashed contact information entered in forms to match a visit to an account. Hashing is not the same as making information anonymous. Meta uses this information to measure and deliver advertising under its own policies. Klaviyo’s website script records browsing, product views, bag additions and checkout starts, and can associate that activity with your email address once you provide it. Campaign and advertising click tags are remembered on your device for up to seven days only with Marketing permission.

Purchase reporting and withdrawal. With Marketing permission, our server can report a completed order to Meta (amount, items, an order reference, hashed email, IP and browser information and available advertising identifiers) and to Klaviyo (email, purchased items and amounts, and shipping city and state). We save the permission with checkout and check the current consent receipt again before these optional reports are sent. Rejecting or withdrawing Marketing stops these optional reports, including for a checkout opened before the change. Missing or unverifiable permission is treated as no permission. Changing settings removes this site’s known optional identifiers for disabled categories and reloads the page to stop already-loaded tracking tools. A choice cannot undo information already sent to a provider; contact us about access or deletion requests.

Global Privacy Control. When your browser sends a Global Privacy Control signal, we keep Marketing tracking off, including optional server-side purchase reports, even if an older saved choice allowed it. Analytics can be chosen separately. Meta’s Limited Data Use and Google’s privacy settings are additional protections, not substitutes for your choices.

Email is a separate choice. Accepting cookies does not subscribe you to marketing email, and rejecting cookies does not unsubscribe you from a list you joined. The email sign-up and checkout email boxes are separate, unticked choices. Order fulfillment, receipts, requested custom-order confirmations and services you explicitly request still use the information needed to provide them. Klaviyo sends custom-order confirmations and separately requested emails even if website tracking is off. Email opens and clicks may be measured as described under Email; cookie settings control website tracking and optional purchase reporting. Use the unsubscribe link to stop marketing email.

Other service requests. Your browser also connects to our hosting, image, font and payment providers to display the shop and process orders. These requests convey technical information such as an IP address; turning off optional tracking does not remove the connections needed to provide those services. Stripe’s own privacy controls apply on its hosted checkout.

Storage and providers. Local bag storage remains until you clear it. Optional experiment and recently viewed storage remains until you withdraw Analytics permission or clear browser data; visit-based experiment storage ends when the tab’s session ends. Google, Meta and Klaviyo set and manage their own identifiers and retention under their privacy notices. Learn more at policies.google.com/privacy, facebook.com/privacy/policy and klaviyo.com/legal/privacy. Changing this site’s settings cannot erase cookies held on another company’s domain. If we add another optional tracking tool or change its purpose, we update this notice and request a new choice as needed.

Provider privacy notices: Google, Meta, Klaviyo, and Stripe.

Your choices

Write to us and we will tell you what we hold about you, correct it, or delete it. Deleting an order record is limited by the tax and accounting records we are required to keep.

If you are in a place with specific privacy rights (California, the EU, the UK), those rights apply and the same email address is how you use them.

Children

This store is not directed at children and we do not knowingly collect information from anyone under 13. If you believe a child has given us information, write to us and we will remove it.

Changes

If this policy changes in a way that matters, the date below changes with it. Homeroom ships within the United States only.