Privacy Policy
Last Updated: August 25, 2026
1. Introduction
Welcome to TinyStoked ("we," "our," or "us"). We operate an e-commerce store selling adventure-themed apparel for families. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at tinystoked.com.
By using our site, you agree to the practices described in this policy. If you do not agree, please do not use our services.
2. Information We Collect
2.1 Information You Provide
- Order information: Shipping name and address, email address, order contents
- Payment information: Processed entirely by Stripe — we never see or store your card details
- Waitlist/email signup: Email address if you join our mailing list
- Support inquiries: Any information you send us via email
2.2 Automatically Collected Information
- Usage data: Pages visited, time on site, referral source. Vercel Analytics measures this for every visitor without cookies; Google Analytics measures it only if you accept analytics.
- Performance data: Core web vitals and load times, via Vercel Speed Insights, for every visitor and without cookies
- Session recordings and heatmaps (only if you accept analytics): Microsoft Clarity records how you move through the site — mouse movement, scrolling, clicks and taps, and which pages you saw — and replays it to us as a video, alongside heatmaps showing where visitors click. Text you type is hidden from these recordings.
- IP address and device info: Browser type, operating system, approximate location (country/region)
- Cookies: Cloudflare Turnstile CAPTCHA tokens on forms; your cookie choice; and, if you accept them, Google Analytics and Microsoft Clarity measurement cookies
3. How We Use Your Information
- Processing and fulfilling your orders
- Transmitting your shipping address to our production partner for apparel manufacturing
- Sending order confirmations and shipping updates
- Responding to customer service inquiries
- Sending marketing emails if you opted in (you can unsubscribe at any time)
- Improving our website and product offerings
- Advertising TinyStoked on other sites and social platforms, measuring whether those ads worked, and showing our ads to people who have visited before — only if you accept the Advertising category
- Detecting and preventing fraud and abuse
- Complying with legal obligations
4. How We Share Your Information
We do not sell your personal information. We share it only with the service providers necessary to run our business:
Apparel Production
Your name and shipping address are sent to our production partner to make and ship your order. Their privacy policy governs how they handle this data.
Stripe (Payments)
All payment processing is handled by Stripe. We receive a confirmation that payment was successful, but never see your card number, CVV, or full billing details. Your order record — email address, shipping details, and what you bought — is held in Stripe; we do not run a separate customer database.
Loops.so (Email)
We use Loops.so to send transactional emails (order confirmations, shipping updates) and optional marketing emails. Your email address is stored in Loops if you opt in or place an order.
Cloudflare (Infrastructure & CAPTCHA)
Our site is served through Cloudflare. Cloudflare Turnstile is used on forms to prevent spam. Cloudflare R2 stores our product images.
Vercel (Hosting)
Our website is hosted on Vercel, so Vercel handles every request to this site whatever you choose here. Vercel Analytics counts page views and Speed Insights measures load times. We treat both as essential and they run for every visitor: they are served from our own domain, set no cookies, cannot follow you to another site, and the data is not sold or shared on. If you would rather not be counted at all, a tracker blocker will stop them.
Advertising platforms
We advertise TinyStoked on other sites and social platforms. If you accept the Advertising category, those platforms' measurement tags are loaded here and can be told that you visited or placed an order, so we can tell which ads work and show our ads to people likely to be interested. They are never told your name, email address, or what you bought. No advertising tag is live at the time of writing — this section names each platform as it is added, and the category stays off until you turn it on either way.
Microsoft (Clarity)
If you accept analytics, we load Microsoft Clarity, which records your visit and replays it to us as a video, and builds heatmaps of where visitors click. It captures mouse movement, scrolling, clicks, taps, and the pages you viewed. Text you type into forms is hidden from the recording, and Microsoft is not given your name, email address, or order details. Clarity sets cookies on your device, and Microsoft also sets identifiers on its own clarity.ms and bing.com domains that it can use to recognise the same browser across other sites that use Microsoft services. If you do not accept analytics, Clarity is not loaded and Microsoft is not contacted.
Google (Analytics and Tag Manager)
If you accept analytics, we load Google Tag Manager, which in turn runs Google Analytics so we can understand how visitors use the site. Both are served from our own domain rather than Google's, and the page-view measurements go to us first, so those carry your approximate location (country and region) instead of your IP address. Google Analytics also sends a small number of requests directly to Google, which we cannot route through our domain, and those do reveal your IP address to Google in the ordinary way. Google never receives your name, email address, or order details. If you do not accept, none of this loads and Google is not contacted at all.
We may also disclose your information if required by law, to protect our rights, or in connection with a business transfer or acquisition.
5. Children's Privacy
Our products are designed for children, but our website services are directed at parents and guardians aged 18 and older. We do not knowingly collect personal information directly from children under 13. When you place an order for children's apparel, any personal information you provide (such as a shipping name) is provided by you as a parent or guardian.
If you believe we have inadvertently collected information from a child under 13, please contact us at privacy@tinystoked.com and we will delete it promptly.
6. Cookies
We use a minimal set of cookies:
- CAPTCHA tokens: Short-lived tokens from Cloudflare Turnstile, used to verify form submissions are from real users.
- Analytics (only if you accept): Google Analytics sets first-party cookies (names beginning
_ga) to tell repeat visits apart; they expire after two years and hold a random identifier, not personal information. Microsoft Clarity sets_clckand_clskto tie a recording to a visit. Both vendors also set cookies on their own domains, as described in section 4. Vercel Analytics and Speed Insights set no cookies at all, which is part of why they are treated as essential rather than being put behind this choice. - Advertising (only if you accept): Cookies set by the advertising platforms we use, to measure whether an ad brought you here and to show you our ads on other sites. None are loaded unless you turn this category on.
- Your cookie choice: A single cookie (
cc_cookie) remembers what you picked in the banner, so we do not have to ask again on every page.
6.1 Your Choices
Google Analytics is off until you turn it on, everywhere in the world. Until you accept, no Google script is loaded and no request is made to Google. Declining is not a signal we pass along; it means Google is not contacted in the first place.
The exception is our host's own measurement, Vercel Analytics and Speed Insights, which runs for everyone. It is served from this domain, sets no cookies, cannot follow you to another site, and is not sold or shared on. We treat it as essential to running the shop rather than as something to ask about; a tracker blocker will stop it if you would rather not be counted.
A banner asks on your first visit, and you can change your answer at any time using the Cookie Preferences link in the footer. If you turn a category off after having turned it on, we delete the cookies it set on this site and reload the page, so nothing that was running keeps running. From that point the tags are not loaded at all, which is what actually stops the tracking.
We remember your answer for one year, then ask again. That is the same for yes and no.
Advertising and retargeting cookies are only ever set if you turn the Advertising category on. It is off by default and stays off until you change it. You can also disable cookies in your browser settings; the shop does not require you to sign in, so browsing and checkout will still work, though we will have to ask about cookies again on every page.
7. Data Retention
- Order data: Retained for up to 7 years for tax and legal compliance.
- Email list: Retained until you unsubscribe or request deletion.
- Analytics data: Aggregated and anonymized; no individual retention period.
8. Your Privacy Rights
California Residents (CPRA)
You have the right to know, access, correct, delete, and opt out of the sale or sharing of your personal information. We do not sell personal information. Turning on the Advertising category lets advertising platforms receive your visit for cross-context behavioural advertising, which California treats as “sharing”; the same toggle in Cookie Preferences is how you opt out, and it is off unless you turn it on. To exercise your rights, contact us at privacy@tinystoked.com.
EEA/UK Residents (GDPR/UK GDPR)
You have rights of access, rectification, erasure, restriction, portability, and objection. Our lawful basis for processing is contract performance (orders), legitimate interests (fraud prevention, and the cookie-free first-party measurement described in section 6.1), and consent (analytics, advertising, and marketing emails). To exercise your rights, contact us at privacy@tinystoked.com.
We will respond to all requests within 30 days (or as required by applicable law).
9. Data Security
We implement industry-standard security measures: HTTPS/TLS for all data in transit, encrypted storage at our service providers, and strict access controls. There are no customer accounts and no passwords to compromise, and we hold no customer database of our own — order data stays with Stripe and our fulfilment partner, and email addresses with Loops. That said, no internet transmission is 100% secure — please contact us immediately if you suspect unauthorized access.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new "Last Updated" date. For material changes, we will notify you by email if you are subscribed to our mailing list. Your continued use of our site after changes are posted constitutes acceptance of the updated policy.