Privacy

What I collect

Just browsing. I don't ask you for anything. PostHog analytics records the pages you view, what you click or submit (not what you type), how long you stay on each page, how far down it you scroll and your browser details, tied to a random ID, not your name. My host passes that data on to PostHog, so PostHog may also get your IP address. On September 16, 2026, I set PostHog to stop saving IP addresses with my analytics. It can still use yours to work out your approximate location, like your city and postal code, and save that. Visits from before the change still have their IP address saved. Session replay and heatmaps, which track your mouse movements, are switched off; if I ever turn them on, I'll say so here first.

Buying a card. Pressing Buy logs the card in analytics and sends you to Stripe's checkout page. Stripe collects your email, name, card details, a US shipping address (even on a pickup) and sometimes a billing ZIP; I never see your card number. Once you've paid, Stripe sends me your email, name, address, what you bought and the total: the order record.

Picking up at a show. Your code is the last eight characters of your Stripe checkout ID, shown on the thank-you page and in your email. Anyone who has your thank-you page link sees which card, what you paid, that it's a pickup, and the code, so treat it like a receipt. The code alone doesn't get you the card; at the table I check it and your name (or email) against my sale email. The address Stripe asks for isn't for delivery: it's how the site checks you're in the US, and the fallback if you never collect and want it posted.

Signing up in the footer. It asks for your email address, nothing else, adds it to my Resend contact list and sends one welcome email.

What it's for

Your email, name and address get the card, the confirmation and the tracking number to you. The signup list is for drops only. Analytics shows me what gets looked at. I don't sell any of it to anyone, and there are no ad trackers.

Who sees it

• Stripe keeps the payment record and your details.
• Amazon DynamoDB (US, us-east-1) holds the order record and Stripe's IDs.
• Resend (US, us-east-1) sends every email from this site, so my sale email (your name, address and email) and your confirmation pass through it; it also holds the signup list.
• PostHog (US) gets the browsing events plus two server events (checkout started, completed): SKU, amount, ship or pickup and your checkout ID, never your name or email. Your browsing isn’t filed under that ID: my code blanks it out of everything analytics sends from your browser, so inside PostHog your browsing and your purchase don’t join up. Only I can look that ID up in Stripe.
• Vercel hosts the site and, like any host, sees your IP address; my code never reads or stores it. Its logs also get the recipient address of any email Resend refuses, the thank-you page address (with your checkout ID; it's in your browser history too) and that ID when my webhook sees an unpaid or malformed session.
• My inbox. Every sale emails me your email address, the name and address you gave Stripe and, for pickups, the code. It's Gmail, so Google holds a copy. Every email the site sends replies to that same address, so a reply to your confirmation or welcome email lands there too.
• Pirate Ship is where I buy the shipping label when I post a card. I copy your name and address into it by hand from my sale email, and your email too, so it can email you the tracking number and a link to follow the parcel on the USPS website. Pirate Ship's help pages say it sends those emails through a company called Postmark. Pirate Ship handles what it gets, including through Postmark, under its own privacy policy.
• USPS carries the parcel. Your name and address are printed on the label, and USPS handles them under its own privacy policy.
• InsureShield is the insurance I add in Pirate Ship when I post a card priced $200 and up. It is provided by UPS Capital Insurance Agency, which may get your name and address with the shipment details and may use them for that insurance, including for any claim I make. UPS Capital and its affiliates handle them under the UPS Capital Privacy Notice.
• Other sites. The cert-lookup links (PSA and CGC) and my social links take you to those companies' sites; their policies apply there, not this one.

Keeping it

Nothing on the site deletes personal data on its own. The order record, your Resend contact and my sale emails stay until I remove them by hand. Resend keeps its own record of sent emails; Stripe, PostHog and Vercel keep theirs, under their own policies. Anything Pirate Ship, USPS or UPS Capital keeps from a shipping label is under their own policies too.

On your device

My code sets no cookies. PostHog's script sets one cookie (its name starts with ph_) and matching browser-storage entries holding a random visitor ID, a session ID, settings, the page address you arrived on (with any checkout ID blanked out) and the page that sent you there; the cookie lasts a year. Stripe's checkout page runs on Stripe's own domain, not mine; anything it stores in your browser is covered by Stripe's privacy policy, not this one.

Your choices

• Unsubscribe. There's no unsubscribe link yet. Reply to any email from the list, or email me, and I'll take you off.
• Analytics. Analytics requests go to grantluebke.com and my host passes them to PostHog, so most ad blockers miss them. There's no opt-out switch. Blocking /ph-relay on this domain stops the browsing analytics; the two checkout events come from my server and can't be blocked.
• Deletion. Email me and I'll take your contact out of Resend. The order record stays; it's my proof of sale. I can't touch Stripe's copy, and browsing analytics has no email to search by. Anything Pirate Ship, USPS or UPS Capital keeps from a shipping label is under their own policies, not mine.

Kids

This site isn't for anyone under 13. If a kid has signed up or ordered, email me and I'll remove it.

Contact

Email me at gluebke2345@gmail.com, or reply to any email the site sent you; both reach the same inbox.