Privacy

What I collect

Just browsing. I don't ask you for anything. PostHog analytics records the pages you view, what you click and your browser details, tied to a random ID, not your name. My host forwards those requests, so PostHog may also get your IP address and rough location. My code doesn't turn on session replay or heatmaps; if I ever do, I'll say so here first.

Buying a card. Pressing Buy logs the card in analytics and sends you to Stripe's checkout page. Stripe collects your email, name, card details, a US shipping address (even on a pickup) and sometimes a billing ZIP; I never see your card number. Once you've paid, Stripe sends me your email, name, address, what you bought and the total: the order record.

Picking up at a show. Your code is the last eight characters of your Stripe checkout ID, shown on the thank-you page and in your email. Anyone who has your thank-you page link sees which card, what you paid, that it's a pickup, and the code, so treat it like a receipt. The code alone doesn't get you the card; at the table I check it and your name (or email) against my sale email. The address Stripe asks for isn't for delivery: it's how the site checks you're in the US, and the fallback if you never collect and want it posted.

Signing up in the footer. It asks for your email address, nothing else, adds it to my Resend contact list and sends one welcome email.

What it's for

Your email, name and address get the card and confirmation to you. The signup list is for drops only. Analytics shows me what gets looked at. I don't sell any of it to anyone, and there are no ad trackers.

Who sees it

• Stripe keeps the payment record and your details.
• Amazon DynamoDB (US, us-east-1) holds the order record and Stripe's IDs.
• Resend (US, us-east-1) sends every email from this site, so my sale email (your name and address) and your confirmation pass through it; it also holds the signup list.
• PostHog (US) gets the browsing events plus two server events (checkout started, completed): SKU, amount, ship or pickup and your checkout ID, never your name or email. Your browsing isn’t filed under that ID — the thank-you page view has it stripped out before it’s sent — so inside PostHog your browsing and your purchase don’t join up. Only I can look that ID up in Stripe.
• Vercel hosts the site and, like any host, sees your IP address; my code never reads or stores it. Its logs also get the recipient address of any email Resend refuses, the thank-you page address (with your checkout ID; it's in your browser history too) and that ID when my webhook sees an unpaid or malformed session.
• My inbox. Every sale emails me your email address, the name and address you gave Stripe and, for pickups, the code. It's Gmail, so Google holds a copy. Every email the site sends replies to that same address, so a reply to your confirmation or welcome email lands there too.
• Other sites. The cert-lookup links (PSA and CGC) and my social links take you to those companies' sites; their policies apply there, not this one.

Keeping it

Nothing on the site deletes personal data on its own. The order record, your Resend contact and my sale emails stay until I remove them by hand. Resend keeps its own record of sent emails; Stripe, PostHog and Vercel keep theirs, under their own policies.

On your device

My code sets no cookies. PostHog's script sets one cookie (its name starts with ph_) and a matching browser-storage entry holding a random visitor ID, a session ID and settings; the cookie lasts a year. Stripe's checkout page runs on Stripe's own domain, not mine; anything it stores in your browser is covered by Stripe's privacy policy, not this one.

Your choices

• Unsubscribe. There's no unsubscribe link yet. Reply to any email from the list, or email me, and I'll take you off.
• Analytics. Analytics requests go to grantluebke.com and my host passes them to PostHog, so most ad blockers miss them. There's no opt-out switch. Blocking /ph-relay on this domain stops the browsing analytics; the two checkout events come from my server and can't be blocked.
• Deletion. Email me and I'll take your contact out of Resend. The order record stays; it's my proof of sale. I can't touch Stripe's copy, and browsing analytics has no email to search by.

Kids

This site isn't for anyone under 13. If a kid has signed up or ordered, email me and I'll remove it.

Contact

Email me at gluebke2345@gmail.com, or reply to any email the site sent you; both reach the same inbox.