The short version
- We never sell your information or share it for advertising.
- Your card number goes to Stripe, our payment processor. We never see or store it.
- No ad trackers and no analytics cookies. The only cookies keep you signed in, hold your cart and protect forms.
- You can see and change your details in your account, or ask us to delete them.
What we collect
When you order
Your name, email, phone number and shipping address; what you want in your box (pursuits, the state you hunt and fish in, experience, shirt size and any notes); and, for gifts, the recipient’s name, address and your gift message. We also keep a record of your orders, subscriptions and shipments.
When you pay
Payment details are entered on Stripe’s secure checkout page and go straight to Stripe. We receive only a confirmation, the amounts, and Stripe’s reference numbers for your payment and subscription.
When you contact us
Whatever you put in the contact form or an email: usually your name, email and message.
When you visit
Like most websites, our server records basic technical details of each request (IP address, browser, the page asked for and the time) to keep the site running, stop abuse such as form spam, and investigate problems. To confirm: how long the hosting provider keeps these logs.
How we use it
- To take payment, build your boxes around what you hunt and fish, and ship them.
- To email you about your orders: confirmations, shipping and tracking notices, and the sign-in links to your account.
- To answer your questions and sort out problems with an order.
- To prevent fraud, keep the site secure, and meet our tax and legal obligations.
We don’t send marketing emails today. If we start, we’ll only send them to people who opt in, and every one will have an unsubscribe link.
Who we share it with
Only the companies that help us run the store, and only what each needs:
- Stripe processes payments and subscriptions (Stripe’s privacy policy).
- EasyPost and the carriers it connects to (USPS, UPS, FedEx) get your name, address and phone number to create shipping labels and deliver your package.
- Our email provider sends order and account emails. To confirm: provider name.
- Our website host stores the site and its database. To confirm: provider name.
- Google Fonts serves the site’s typefaces, so Google sees your IP address when the fonts load.
We don’t share your details with the brands whose gear appears in our boxes. We may disclose information if the law requires it, to protect our rights or someone’s safety, or to a buyer if the business is ever sold. We do not sell personal information, and we don’t “share” it for cross-context behavioral advertising.
Cookies
The site sets only the cookies it needs to work. There are no advertising or analytics cookies.
| Cookie | What it does | How long |
|---|---|---|
.dbg.account | Keeps you signed in to your account after you click a sign-in link. | 30 days |
.dbg.cart | Remembers what’s in your merch cart (encrypted). | 14 days |
.AspNetCore.Antiforgery.* | Protects forms from being submitted by other websites. | Until you close the browser |
.AspNetCore.Mvc.CookieTempDataProvider | Carries a one-time message, like “Saved”, to the next page. | Until it’s read |
.dbg.admin | Signs in our staff. Customers never get it. | Up to 10 hours |
Stripe sets its own cookies on its checkout and billing pages to process payments and prevent fraud.
How long we keep it
We keep order, payment and shipping records for as long as we need them for accounting and tax purposes, then delete them. To confirm with an accountant: the retention period (often 7 years). Contact-form messages are kept only as long as needed to help you. Sign-in links stop working after one use or when they expire (an hour for links you request, 14 days for links in order emails).
Your choices & rights
- See and correct it. Your account shows your orders, boxes and address, and you can change your box details and address there.
- Delete it. Ask us to delete your information. We’ll do so except for records the law requires us to keep, and we’ll cancel any active subscription first.
- Get a copy. Ask and we’ll send you the personal information we hold about you.
Depending on where you live, state privacy laws may give you further rights, such as knowing what categories of information we collect and appealing a decision about a request. Contact us to use any of these rights; we won’t treat you differently for doing so. We may need to confirm your identity first, usually by emailing the address on your account.
Keeping it safe
The site runs over HTTPS. Card details never reach our servers. Sign-in links are single-use and stored only in scrambled (hashed) form. Our admin area is limited to staff, with strong passwords and lockouts after repeated failed sign-ins. No system is perfectly secure, but we take reasonable steps and will tell you if a breach affects your information as the law requires.
Children
The site isn’t meant for children under 13, and we don’t knowingly collect their information. Customers must be 18 or have a parent or guardian order for them. If you think a child has given us information, contact us and we’ll delete it.
Changes & contact
We’ll update this policy when our practices change; the date at the top shows when. For anything about your privacy, use our contact form. To confirm: a postal address for privacy requests, if the business has one.