Privacy Policy

Privacy Policy

Last updated: May 24, 2026

Buy My Stash (operated by A&J Sales LLC, Saint George, UT) respects your privacy. This policy explains what we collect, why, and how it's used.

Information We Collect

You give us:
- Name, email address, phone (optional), shipping address — to fulfill your order
- Payment details — processed entirely by Stripe; we never see or store your card number
- Account password — stored as a one-way bcrypt hash; we cannot recover it

Automatically collected:
- Pages you view, items you add to your cart (used to improve the store)
- Device, browser, IP address (used for security, fraud prevention, and analytics)
- Cookies for cart contents, session login, CSRF protection — see Cookies below

How We Use Your Information

• Process and ship your orders
• Send transactional emails (order confirmation, shipping notification, password reset)
• Provide customer support when you contact us
• Improve site performance and detect fraud
• Comply with tax and legal obligations

We do not sell your personal information. We do not share it with advertisers.

Service Providers

We share the minimum data needed with these providers:

• Stripe — payment processing (see Stripe's privacy policy)
• Resend — transactional email delivery
• Google Analytics — anonymized usage statistics
• USPS / UPS — to print shipping labels for your order
• Cloudflare — DDoS protection and CDN
• Railway / Neon — hosting + database

Cookies

We use cookies to keep you signed in, remember your cart, and protect against forgery (CSRF). You can disable cookies in your browser; doing so will prevent checkout from working.

Data Retention

• Order records: retained for 7 years (tax + legal requirement)
• Account data: retained until you ask us to delete it
• Logs: 90 days

Your Rights

You can:

• Access the data we have on you
• Correct inaccurate information
• Delete your account and personal data
• Object to certain processing

Email us at the address in our contact page and we'll respond within 30 days.

California residents (CCPA), EU/UK residents (GDPR): you have the same rights, plus the right to opt out of any future sale of your data (we don't sell it, but the opt-out is on file).

Children

Buy My Stash is not directed at children under 13. We do not knowingly collect their data.

Changes

If we make material changes to this policy we'll post a notice on the site and update the "Last updated" date above.

Contact

Questions? See our contact page.