Privacy Policy

This policy explains what personal data Campfire Tales collects, why, how we use it, and what rights you have over it. Short version: we collect only what's necessary to fulfill your order and talk to you about it. We don't sell your data.

Who's responsible

Campfire Tales (registered DBA, Wisconsin) — data controller. PO Box 171, Brookfield, WI 53005. Privacy contact: support@campfiretales.shop.

What we collect

• Order data — name, shipping address, email, items ordered, and total charged. We collect this when you place an order.
• Payment data — handled entirely by Stripe. We never see or store your card number, CVV, or full card data. We see a token, the last 4 digits, and the card brand.
• Communications — any email you send us, and our replies.
• Site usage data — IP address, browser type, pages visited, and session timing, collected by Cloudflare (our hosting and CDN provider) for security, abuse prevention, and operational analytics. We don't use third-party analytics (no Google Analytics, Facebook Pixel, or similar).
• Your cart — stored in your own browser via localStorage. Never sent to our servers until you click "Checkout". If you clear your browser data, your cart is gone.

Why we use it

• To process, fulfill, and ship your order
• To email you about your order (confirmation, tracking, issues)
• To respond to questions or support requests
• To detect fraud, abuse, or unauthorized access
• To comply with tax, accounting, and other legal obligations

We do not send marketing emails, and we do not use your data to retarget ads.

Who we share it with

We share your data only with the service providers we need to run the business:

• Stripe — payment processing. See Stripe's privacy policy.
• Teelaunch, Printify, and Apliiq — print-on-demand fulfillment partners. When you order a physical product, we share your name, shipping address, email, and order details with whichever partner produces that product. Each has its own privacy policy — links on their websites.
• Resend — transactional email delivery (order confirmations, support replies). See Resend's privacy policy.
• Cloudflare — hosting, CDN, and edge security. See Cloudflare's privacy policy.

We do not sell your data. We do not share it for advertising. We will disclose data if required by law (subpoena, court order) or to protect our rights, safety, or property.

How long we keep it

• Order records: retained ~7 years to meet US tax and accounting requirements
• Support email threads: retained ~2 years
• Security and operational logs (via Cloudflare): ~90 days typical
• Your cart (browser localStorage): retained in your browser until you clear it

Cookies and tracking

We don't set first-party tracking cookies. Cloudflare sets session cookies for security and to mitigate abuse — these are essential to the site working, and can't be disabled without breaking functionality. We do not use any ad-tech tracking, analytics pixels, or cross-site trackers.

Your rights

Regardless of where you live, you have the right to:

• Know what data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data (subject to legal record-keeping requirements — we can't delete order records we're legally required to keep)
• Receive a copy of your data in a portable format
• Object to how we use it

To exercise any of these rights, email support@campfiretales.shop from the address on your order. We'll respond within 30 days.

California residents

California law (CCPA/CPRA) gives you the right to know what categories of personal information we've collected, to whom we've disclosed it, and to request deletion. Because we do not sell personal information and do not share it for cross-context behavioral advertising, there's nothing to opt out of — but the right exists. Submit requests via the email above. You may also designate an authorized agent in writing.

Children

We don't knowingly collect data from anyone under 13, and the site isn't directed to children. If you believe a child has provided us personal information, email us and we'll delete it.

International users

At launch, we ship to the US only. If you're visiting the site from outside the US, your data will be transferred to and processed in the United States, which may have different data protection rules than your country.

Security

We use industry-standard security practices — TLS encryption in transit, access controls on our systems, and no storage of payment card data. No system is perfectly secure, so we can't guarantee absolute security, but we take it seriously.

Changes to this policy

When we update this policy, the "Last updated" date at the top changes. Material changes will be noted on the site.

Contact

Privacy questions, data requests, or concerns: support@campfiretales.shop or Campfire Tales, PO Box 171, Brookfield, WI 53005.

This policy is drafted from industry standards and applicable US consumer-data laws. It is not legal advice. For legal advice specific to your situation, consult a licensed attorney.