Privacy Policy

When you join our email list (drop alerts, Collector's Club, or the 15% welcome code), we collect your email address and the date you joined.

When you place an order, we collect your name, email address, delivery address, phone number if you provide one, order details, and any message you add at checkout. Your delivery address is passed to our shipping partners so your order can actually reach you.

When you contact us, we collect your name, email address, the topic you selected, any order number you give us, and your message.

When you browse the site, our analytics provider records aggregated, non-identifying information such as which pages were viewed and roughly where in the world the visit came from. This is used to understand what's working, not to build a profile of you.

All payments are processed by Stripe, a PCI-DSS compliant payment processor. When you pay, your card details go directly to Stripe — they never reach our servers and we never store them.

We receive confirmation that a payment succeeded, along with your name, email, billing and delivery address, and the items you bought. That's what lets us send your order and issue a refund if something goes wrong.

Stripe's own privacy practices govern how they handle your payment data. You can read their policy at stripe.com/privacy.

We use a small number of cookies and similar storage that are necessary for the site to work — keeping your shopping cart intact between pages, remembering that you've already completed a security check, and keeping the site secure.

We also use privacy-focused analytics to count visits and see which pages are popular. This does not track you across other websites and is not used for advertising.

We do not run advertising cookies, retargeting pixels, or sell audience data to ad networks. If that ever changes, this policy will be updated and a consent banner will appear before any such cookie is set.

Our products are bought by adults for children, and our store is intended to be used by adults. We do not knowingly collect personal information from anyone under 13.

If a child has submitted information to us without a parent's or guardian's consent, contact us and we will delete it promptly.

Kids are very welcome to browse with a parent — but the purchase, the account, and the email address should be an adult's.

If you join our email list, we'll send you drop alerts, restock notices, and occasional collection updates. We send roughly one to four emails a month — not daily.

If you order, we'll send transactional emails: an order confirmation, a receipt, and shipping updates. These are part of the purchase and can't be opted out of while an order is in progress.

Every marketing email has a one-click unsubscribe link at the bottom. Unsubscribing takes effect immediately and will not affect your account or any order in progress.

The site is served over encrypted HTTPS. Access to customer data is limited to the small number of people who need it to run the store.

All payment data is handled by Stripe under their own security programme, which is certified to PCI-DSS Level 1.

No system is perfect. In the unlikely event of a breach affecting your personal information, we will notify affected customers and any relevant authorities as required by law.

Wherever you live, you can ask us to do any of the following, and we will respond within 30 days:

See what personal information we hold about you. Correct anything inaccurate. Delete everything we hold, unless we're legally required to keep it (for example, tax records of a completed sale). Stop sending you marketing email. Receive a copy of your data in a portable format.

If you are in California, the CCPA additionally gives you the right to know what categories of personal information we collect and to opt out of any sale of that information — we do not sell personal information, so there is nothing to opt out of.

If you are in the EU, UK or Switzerland, the GDPR gives you the rights above plus the right to object to processing and to lodge a complaint with your local supervisory authority.

To exercise any of these, email us. We will never charge you for making a request and we will not make you jump through hoops to do it.

If we make a material change to how we handle your information, we'll update the date at the top of this page and, where the change is significant, email our subscribers to tell them.

Continuing to use the site after an update means you accept the revised policy.

Squishy World is the data controller for the information described in this policy. If you have a concern you'd rather raise formally, email us first — we'd much rather resolve it directly than have you escalate.