TL;DR
Who we are
We're Boneyard Tees — a custom apparel shop based in Collegeville, PA. When you buy a shirt, request a quote, or chat with our AI mascot Merica, we collect the information we need to ship your order, answer your questions, and run the business. Nothing more. Nothing sold.
If you want the short version: we collect order details to ship orders, use Google Analytics to understand traffic, and route payments through Stripe (we never see your card number). You can email us any time to ask what we have on file or request deletion. Address + email at the bottom.
2. What we collect
- Order information — your name, shipping address, email, phone number, and order contents. Required to fulfill and ship.
- Payment information — handled entirely by Stripe. We see the last 4 digits of your card, billing zip, and a transaction ID. We never see your full card number, CVV, or expiration.
- Quote / estimate requests — if you request a custom quote, we save your contact info, the artwork you uploaded, and your specs (sizes, quantities, placement) so we can build the quote and reference it later.
- Cart contents — stored in your browser's
localStorage. We don't see this until you check out. Clear your browser data and it's gone. - Chatbot conversations — when you talk to Merica, the conversation is sent to Anthropic's Claude API to generate the response. Logs are retained for up to 90 days for debugging and abuse prevention.
- Returns + customer service — if you request a return or message us, we keep the conversation tied to your order.
- Analytics + technical data — IP address, browser type, pages viewed, referring URL, approximate location (city level). Used to measure traffic and detect abuse. See section 05.
3. Why we use it
- Fulfill orders — print, package, and ship the stuff you bought.
- Customer service — answer questions, process returns, fix problems.
- Quotes — build accurate custom quotes from your specs and artwork.
- Transactional email — order confirmation, shipping notice, quote, cancellation, pickup-ready.
- Marketing email — only if you opt in (newsletter signup). You can unsubscribe from any email.
- Analytics — understand which pages people use so we don't waste effort on dead corners of the site.
- Fraud + abuse prevention — detect card fraud, bot traffic, and chatbot abuse.
- Legal compliance — tax records, accounting, lawful requests.
5. Cookies and tracking
We use Google Analytics 4 and Google Tag Manager to measure site traffic. GA4 sets a cookie that assigns your browser a random identifier so it can count returning visits. We don't use this to build advertising profiles or sell to ad networks.
We do not use third-party advertising cookies, retargeting pixels, or social-media tracking pixels.
To opt out:
- Install the Google Analytics opt-out browser add-on to block GA4 across all sites.
- Enable "Do Not Track" or "Global Privacy Control" in your browser — we honor both signals.
- Use your browser's settings to block cookies from this site.
6. How long we keep it
- Order records — kept indefinitely for tax, accounting, and warranty purposes.
- Quote requests — kept indefinitely so we can reference past jobs.
- Cart (localStorage) — lives in your browser until you clear it or check out.
- Chatbot conversation logs — up to 90 days, then deleted.
- Analytics data — GA4 default retention (currently 14 months for user-level data).
- Marketing email list — until you unsubscribe.
7. Your rights
Depending on where you live (GDPR in the EU/UK, CCPA in California, similar laws elsewhere), you may have the right to:
- Access — ask what data we have about you.
- Correct — fix anything that's wrong.
- Delete — request we erase your data (subject to legal retention requirements like tax records).
- Export — get a copy of your data in a portable format.
- Object — tell us to stop processing your data for marketing or analytics.
- Unsubscribe — opt out of marketing email any time via the link in any marketing email or your account preferences.
- Non-discrimination — we won't deny service, charge different prices, or provide a lower quality of service if you exercise these rights.
Email privacy@boneyardtees.com with the subject line "Privacy Request" and we'll respond within 30 days.
8. Children
This site is not directed at children under 13. We don't knowingly collect personal information from anyone under 13. If you believe a child has given us information, email us and we'll delete it.
9. Security
All traffic to this site is encrypted in transit (HTTPS). Payments go through Stripe (PCI-DSS Level 1). Admin access requires a one-time login link sent to a known email (no passwords stored). Database access is restricted via row-level security policies. We follow industry-standard practices to protect your data, but no system is 100% secure — if a breach occurs and your information is affected, we'll notify you per applicable law.
10. Changes
We may update this policy as the business or the law changes. When we do, we'll bump the "Last updated" date at the top. Material changes will be announced via email to anyone with an active order or marketing subscription.