Privacy

What we collect

Only what is needed to fulfil an order lawfully, plus what the law requires us to keep as evidence.

• Contact details — your name, email address and, if you give one, a phone number.
• Delivery details — the address an order ships to, including any address you save for reuse.
• Order history — what you ordered, when, what it cost, and every change of status on it.
• Age-verification evidence — the fact that a check passed, when, and the IP address and browser user-agent it came from. We are required to be able to show this.
• Support messages — anything you send us through the chat or by email, so we can answer it.
• Newsletter subscription — your email address, if you choose to give it, and where you subscribed from.

What we never collect

Some of the most sensitive data a shop normally holds simply does not exist here, and that is by design rather than by promise.

• Card numbers, expiry dates and security codes. No payment is taken on this website, so none is ever entered, transmitted or stored.
• Third-party advertising or analytics trackers. There is no advertising pixel, no cross-site tracking, and no tag manager on this site — partly on principle, and partly because paid advertising is not permitted in this category anyway.
• Any data about you sold or rented to anyone. We do not do this, and there is no arrangement under which we would.

Cookies and browser storage

We use the smallest set that makes the site work. None of it is used to profile you or to follow you to other sites.

• A cart cookie holding which items you have selected. It holds no prices — those are always recalculated on our servers.
• A state preference, so we can show you what can lawfully ship to you without asking twice.
• A record in your browser that an age check passed, held for 30 days before we ask again. This one never leaves your device.
• A session cookie when you are signed in.

Who else sees your data

Only the parties needed to get an order to you, and only the fields they need to do it.

• The carrier delivering your order — the delivery address and the signature requirement, not your order history.
• Our hosting, database and file-storage providers, who hold data on our behalf under contract and do not use it for anything else.
• Our email provider, to send order and support messages.
• A state or federal authority, where the law requires it — including the monthly delivery reports the PACT Act requires for vapor products.

How long we keep it

Order records and the age-verification evidence attached to them are kept for as long as the law requires us to be able to produce them, which is longer than we would otherwise choose. Support messages and newsletter subscriptions are kept until you ask us to remove them.

When you ask for deletion, your personal details are erased while the minimum legally required order record is retained in a form that no longer identifies you.

Your rights

Wherever you live in the United States, we will honour these. Residents of California and other states with comprehensive privacy laws have them by statute; we extend the same handling to everyone rather than sorting customers by ZIP code.

• Ask for a copy of the personal data we hold about you.
• Ask us to correct anything inaccurate.
• Ask us to delete your data, subject to the record-keeping the law obliges us to maintain.
• Opt out of marketing email at any time, with one click, without affecting your orders.
• Ask us how a decision about an order was reached.

Contacting us about privacy

Write to support@example.com and say what you want. We will confirm we have received it and tell you what we are doing about it. We do not require you to use a specific form of words.