Privacy Policy

This policy explains what personal data Campfire Tales collects, why, how we use it, and what rights you have over it. Short version: we collect only what's necessary to fulfill your order and talk to you about it. We don't sell your data.

Who's responsible

Campfire Tales (registered DBA, Wisconsin) — data controller. PO Box 171, Brookfield, WI 53005. Privacy contact: [email protected].

What we collect

• Order data — name, shipping address, email, items ordered, and total charged. We collect this when you place an order.
• Payment data — handled entirely by Stripe. We never see or store your card number, CVV, or full card data. We see a token, the last 4 digits, and the card brand.
• Communications — any email you send us, and our replies.
• Beta sign-ups — the name and email you enter in the Campfire Studio beta form on /studio. Used to email you when the beta opens, and, only if you ticked the box for it, Campfire Studio updates or news about other Campfire Tales projects.
• Site usage data — IP address, browser type, pages visited, and session timing, collected by Cloudflare (our hosting and CDN provider) for security, abuse prevention, and operational analytics. We don't use third-party analytics (no Google Analytics, Facebook Pixel, or similar).
• Your cart — stored in your own browser via localStorage. Never sent to our servers until you click "Checkout". If you clear your browser data, your cart is gone.

Why we use it

• To process, fulfill, and ship your order
• To email you about your order (confirmation, tracking, issues)
• To respond to questions or support requests
• To tell beta sign-ups when the Campfire Studio beta opens
• To detect fraud, abuse, or unauthorized access
• To comply with tax, accounting, and other legal obligations

We do not send marketing emails, and we do not use your data to retarget ads.

Product reviews

After an order, we email the address on it once to ask for a review: about 10 days after it ships, or 3 weeks after you order if no shipping update reaches us. There is no second email for that order, and the "No more review emails" link in it stops future review emails to this address, for any later order. If you leave a review, we store your rating, title, text and the display name you choose, linked to your order so that only buyers can review. The site shows only the display name, rating, title, text and month; your email and order details are never shown. To have a review removed, email [email protected].

Who we share it with

We share your data only with the service providers we need to run the business:

• Stripe — payment processing. See Stripe's privacy policy.
• Fulfillment partners — print-on-demand production and shipping. When you order a physical product, we share your name, shipping address, email, and order details with whichever partner produces that product. Each partner has its own privacy policy — contact us at the email below if you need to know which partner handled a specific order.
• Resend — transactional email delivery (order confirmations, support replies). See Resend's privacy policy.
• Cloudflare — hosting, CDN, and edge security. See Cloudflare's privacy policy.

We do not sell your data. We do not share it for advertising. We will disclose data if required by law (subpoena, court order) or to protect our rights, safety, or property.

How long we keep it

• Order records: retained ~7 years to meet US tax and accounting requirements
• Support email threads: retained ~2 years
• Security and operational logs (via Cloudflare): ~90 days typical
• Your cart (browser localStorage): retained in your browser until you clear it

Cookies and tracking

We don't set first-party tracking cookies. Cloudflare sets session cookies for security and to mitigate abuse — these are essential to the site working, and can't be disabled without breaking functionality. We do not use any ad-tech tracking, analytics pixels, or cross-site trackers.

Your rights

Regardless of where you live, you have the right to:

• Know what data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data (subject to legal record-keeping requirements — we can't delete order records we're legally required to keep)
• Receive a copy of your data in a portable format
• Object to how we use it

To exercise any of these rights, email [email protected] from the address on your order. We'll respond within 30 days.

California residents

California law (CCPA/CPRA) gives you the right to know what categories of personal information we've collected, to whom we've disclosed it, and to request deletion. Because we do not sell personal information and do not share it for cross-context behavioral advertising, there's nothing to opt out of — but the right exists. Submit requests via the email above. You may also designate an authorized agent in writing.

Children

We don't knowingly collect data from anyone under 13, and the site isn't directed to children. If you believe a child has provided us personal information, email us and we'll delete it.

International users

We ship to the United States, Canada, the United Kingdom, Australia and New Zealand. If you're visiting the site from outside the US, your data will be transferred to and processed in the United States, which may have different data protection rules than your country.

Security

We use industry-standard security practices — TLS encryption in transit, access controls on our systems, and no storage of payment card data. No system is perfectly secure, so we can't guarantee absolute security, but we take it seriously.

Changes to this policy

When we update this policy, the "Last updated" date at the top changes. Material changes will be noted on the site.

Contact

Privacy questions, data requests, or concerns: [email protected] or Campfire Tales, PO Box 171, Brookfield, WI 53005.

This policy is drafted from industry standards and applicable US consumer-data laws. It is not legal advice. For legal advice specific to your situation, consult a licensed attorney.