Privacy policy

Information we collect

• Account details: name, email address and/or phone number, and password (stored as a salted hash — we never see or store your plaintext password).
• If you sign in with Google or Facebook: your name, email address, and a unique account identifier from that provider. We don't receive your social media password.
• Order details: shipping address, phone number, and the products/customizations you order.
• Custom design uploads: any artwork or images you upload for a custom-printed order.
• Usage data collected automatically: IP address and basic device/browser information, used for security (e.g. fraud prevention, CAPTCHA scoring) and to keep you signed in.

How we use your information

• To create and manage your account and process your orders.
• To arrange courier delivery of your order through our shipping partner.
• To process payments through our supported payment partners (for orders not paid on delivery).
• To send order updates and, if you request one, a password-reset link or code by email or SMS.
• To calculate and track loyalty/reward points and referral bonuses on your account.
• To protect the store against automated abuse (e.g. Google reCAPTCHA on the forgot-password form).

Cookies

We use a single essential cookie to keep you signed in — it stores your session token, is marked httpOnly (inaccessible to page scripts), and is only ever sent to our own servers. We don't use third-party advertising or tracking cookies.

Who we share data with

We share only what's needed to fulfill your order or protect the store, with: our courier partner (to deliver your order), our payment partners (to process a payment you initiate), our SMS provider (to deliver an OTP/verification code, if you sign up or reset your password with a phone number), and Google reCAPTCHA (to verify the forgot-password form isn't being abused by a bot). We do not sell your personal data to anyone.

Data retention

We keep your account and order data for as long as your account is active. Records we're legally required to retain (e.g. for tax/accounting purposes) are kept as required by law even after your account is deleted, but are no longer linked to an active profile.

Your rights

You can request a copy of the personal data we hold about you, or request that it be deleted — see our data deletion instructions for how. For any other privacy question, email [email protected].

Changes to this policy

If this policy changes in a material way, we'll update the date at the top of this page.