Quick Summary
We collect only the information needed to process your orders and run our shop. We don't sell your data. We use Stripe for payments, Supabase for storing order data, Resend for sending emails, and Vercel for hosting. You can request deletion of your account at any time.
1. Who We Are
This Privacy Policy describes how Squishyville (operated by Yuan Shi, a sole proprietor in the United States) collects, uses, and shares personal information when you visit squishyville.com or place an order.
2. Information We Collect
Information you provide
- Account information: Name, email address, password (encrypted), and optionally a saved address book.
- Order information: Shipping address, billing address, contact phone (if provided), and the products you purchase.
- Payment information: Card details are collected and stored directly by Stripe — we never see or store your full card number. We retain a tokenized reference and the last 4 digits for fraud prevention.
- Communications: Emails you send us (e.g., support requests, replies to order confirmations).
Information collected automatically
- Usage data: Pages visited, time spent on pages, links clicked, browser type, device type, and approximate location (city-level, from IP address).
- Cookies and similar: Session tokens for authentication, cart contents, and basic analytics. We don't use third-party advertising or tracking cookies.
3. How We Use Your Information
| Purpose | Data Used |
|---|---|
| Process and fulfill your orders | Name, address, email, order details |
| Send order confirmations & updates | Email, order status |
| Verify your identity for support | Email, order ID |
| Prevent fraud & abuse | IP, payment tokens, login activity |
| Comply with legal obligations | Order & tax records |
| Improve our site | Aggregated usage data |
4. Who We Share Information With
We share your information with service providers necessary to operate the shop, all subject to confidentiality agreements:
- Stripe, Inc. — Payment processing. Stripe Privacy Policy
- Supabase Inc. — Database, authentication, and file storage. Supabase Privacy Policy
- Resend — Transactional email delivery. Resend Privacy Policy
- Vercel Inc. — Website hosting. Vercel Privacy Policy
- Shipping carriers — USPS, UPS, FedEx (only your shipping address and the items being delivered).
We do not sell your personal information to advertisers, data brokers, or any third parties.
We may disclose information if required by law (subpoena, court order) or to protect our legal rights, safety, or property.
5. Data Retention
- Order records: Retained for 7 years for tax and accounting purposes (US IRS requirement).
- Account data: Retained as long as your account is active.
- Marketing emails: We don't currently send marketing emails. If we add a newsletter, you'll explicitly opt in and can unsubscribe anytime.
- After account deletion: Personal identifiers are removed within 30 days; only anonymized order records remain (required for tax law).
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal information we hold about you;
- Correct inaccurate information;
- Delete your account and associated personal data (subject to tax retention exceptions);
- Object to certain uses of your data;
- Receive a copy of your data in a portable format;
- Withdraw consent for any optional processing.
To exercise these rights, email orders@squishyville.com from the email address associated with your account. We respond within 30 days.
California residents (CCPA / CPRA)
California residents have additional rights to know what personal information we collect, request deletion, and opt out of "sale" of personal information. We do not sell personal information. To exercise CCPA rights, email us as above.
7. Children's Privacy
Squishyville is a general-audience site and is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will promptly delete it.
Customers aged 13–17 should obtain parental consent before placing orders or creating accounts.
8. Cookies
We use the minimum cookies needed for the site to function:
- Essential cookies: Authentication, shopping cart, security tokens.
- Functional cookies: Remember your preferences (e.g., last category viewed).
We do not use advertising cookies, cross-site tracking, or third-party analytics that profile you. You can control cookies via your browser settings, though disabling essential cookies may prevent the shop from working.
9. Data Security
We use industry-standard measures to protect your data:
- HTTPS encryption for all traffic;
- Passwords stored as one-way bcrypt hashes (we never see your password);
- Payment data tokenized by Stripe (PCI-DSS compliant);
- Database access restricted by row-level security policies.
No system is 100% secure. If we become aware of a data breach affecting your personal information, we will notify you and applicable authorities as required by law.
10. International Visitors
Squishyville ships only within the United States, and our servers and service providers are primarily based in the United States. If you visit from outside the US, your information will be transferred to and processed in the US, which may have different data protection laws than your country.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted here with an updated date. For significant changes, we may also notify you by email.
12. Contact Us
Privacy questions or requests?
Email: orders@squishyville.com
Operator: Yuan Shi (sole proprietor)
We respond to all privacy requests within 30 days.