Privacy Policy
Last updated: September 19, 2026
Spooky Thistle is a small shop, and I treat your information the way I'd want mine treated. This page explains what I collect, why, and what I do with it.
The short version
I do not sell, rent, or trade your personal information to anyone, ever. I share it only with the services I need to process your payment and get your order to your door.
What I collect
When you place an order, I collect the information needed to fulfill it: your name, shipping and billing address, email address, phone number, and the details of what you ordered.
If you create an account, I also store your login details and your order history. Creating an account is optional — you're welcome to check out as a guest.
If you sign up for the newsletter, I collect your email address for that purpose.
When you visit the site, I collect basic analytics data: how many people visit, which pages and products they look at, and what type of device and browser they're using. This is aggregate information about traffic patterns, not a profile of you personally.
I do not store your credit card number. Payment information goes directly to Stripe and never touches my servers.
Why I collect it
- To process and ship your order, and to send order confirmations and tracking
- To handle returns, refunds, and customer service
- To let you log in and see your own order history, if you've made an account
- To send the newsletter, if you've asked for it
- To understand which parts of the site people actually use, so I know where to spend my time improving it
- To meet basic legal and tax recordkeeping requirements
Who I share it with
Only the companies that make the shop work:
- Stripe — my payment processor. Your card details are handled securely on their end under their own privacy policy.
- Shipping carriers (UPS and USPS) — your name and shipping address, so your package can get to you.
- Google Analytics — anonymous traffic data about site visits and device types.
That's the whole list. No advertisers, no data brokers, no selling your email to anyone.
The newsletter is sent by me, personally, from my own email — your address isn't loaded into any third-party marketing platform. If that changes as the shop grows, I'll name the service here before I start using it.
I may also disclose information if I'm legally required to — a subpoena, a court order, that kind of thing.
The newsletter
If you subscribe, I'll email you about new products, restocks, and sales. That's it — I'm not going to flood your inbox, and I'm not sharing your address with anyone else.
You're only on the list if you actively opted in. Newsletters go out with every recipient blind-copied, so no other subscriber can see your address.
To unsubscribe, reply to any newsletter and say so, or email privacy@spookythistle.com. I'll take you off the list right away — no forms, no "are you sure."
Buying something does not automatically subscribe you. Order confirmations and shipping notices are separate from the newsletter, and you'll get those whether you're subscribed or not, because you need them.
Accounts
If you create an account, you can log in at any time to see your orders and update your details. Use a real password, not one you've reused from somewhere else. If you want your account deleted, email privacy@spookythistle.com and I'll take care of it — though I'll still need to keep the underlying order records for tax purposes.
Cookies and analytics
This site uses cookies. Some are functional — they keep items in your cart while you shop and keep you logged in if you have an account. Others come from Google Analytics and help me see how many people visit and which pages they spend time on.
You can block or delete cookies in your browser settings at any time. Blocking functional cookies may break the cart. You can also opt out of Google Analytics entirely using Google's browser add-on at tools.google.com/dlpage/gaoptout.
How long I keep your information
Order records are kept as long as I need them for returns, customer service, and tax purposes — generally several years. Newsletter subscriptions are kept until you unsubscribe. Analytics data is retained according to Google's standard retention settings.
Your choices
You can ask me what information I have about you, ask me to correct it, or ask me to delete it — email privacy@spookythistle.com or reach out through the contact page. If you're in a state with specific privacy rights (California, Colorado, Virginia, and others), those rights apply to you here regardless of where you live; I'd rather just honor the request than argue about jurisdiction.
Children
This shop isn't intended for children under 13, and I don't knowingly collect information from them. If you believe a child has given me their information, contact me and I'll delete it.
Security
The site runs over a secure encrypted connection (HTTPS), and payments are handled by Stripe, which is PCI-compliant. No system is perfect, but I take reasonable steps to protect what I hold.
Changes to this policy
If I change how I handle data, I'll update this page and change the date at the top.
Questions
Email me at privacy@spookythistle.com or reach out through the contact page. I read every message myself.