Privacy Policy

This policy explains what information Reverb Crystals collects when you browse our site, create an account or place an order, what we use it for, who we share it with, and the choices you have. We collect what we need to run the shop and to advertise it on Meta (Facebook and Instagram). We don't sell your information for money, but we do share some of it with Meta for advertising, as explained below.

What we collect

Your account

If you create an account, we store:

• your name and email address, and a phone number if you choose to add one;
• your password, stored only as a one-way scrambled “hash”, so we can check it when you sign in but can never read it;
• a shipping address, if you save one to speed up future orders;
• your wishlist, and the items in your cart so it follows you between devices.

You don't need an account to shop. You can check out as a guest.

Your orders

When you place an order we keep a record of it: your email address, what you bought and what you paid, the shipping name and address you gave at checkout, a payment reference from Stripe, and shipping and tracking details once your order is on its way.

Payments

Checkout happens on a secure payment page run by Stripe, our payment processor. Your card details go straight to Stripe. We never see them and never store them. Stripe tells us whether the payment went through, along with the email address and shipping address you entered, so we can fulfill your order.

Visits to our site

We use Plausible, a privacy-friendly analytics tool that we host ourselves, to count visits and see which pages are popular, and to see how many visits lead to an order (including the order total and number of items). Plausible doesn't use cookies, doesn't build a profile of you, and doesn't track you across other websites. Because it runs on our own server, that data isn't shared with anyone. You can read how the software works in Plausible's data policy.

Google Analytics

We also use Google Analytics, a service from Google, to understand how visitors use our site. It loads from Google's servers on every page, so Google receives your IP address, details about your browser and device, the pages you visit here and the site that sent you, and it sets its own cookies (see Cookies and browser storage).

Google Analytics is also told when you add a product to your cart (the product's name, ID and price), when you start checkout (the cart total), and when you complete an order (the order total, currency and the reference for your checkout session). We don't send Google your name, email address or other contact details. Google handles this data under its own privacy policy, and explains more in how Google uses information from sites that use its services.

Meta (Facebook) Pixel and Conversions API

We advertise on Facebook and Instagram, and we use two tools from Meta Platforms (the company behind them) to measure how well those ads work and to help Meta show our ads to people likely to be interested: the Meta Pixel, which runs in your browser, and the Meta Conversions API, which our server uses to report completed orders.

The Meta Pixel loads from Meta's servers on every page of our site. Because of that, Meta receives your IP address, details about your browser and device, and the pages you visit here, and the pixel may set its own cookies (see Cookies and browser storage). If you're signed in to Facebook or Instagram, Meta may be able to link this activity to your account. The pixel tells Meta:

• each page you view;
• when you add a product to your cart: the product's name, ID and price;
• when you start checkout: the number of items and the cart total;
• when you complete an order: the number of items, the order total and the currency.

The Conversions API. When an order is paid, our server also reports the purchase directly to Meta. That way it's counted even if the pixel was blocked in your browser. The report contains:

• our order number, the IDs of the products you bought, the number of items, the order total and currency;
• your email address, first and last name, phone number (if one was given at checkout), and the city, state or province, ZIP or postal code and country from your order. We never send your street address;
• your customer account ID, if you were signed in when you checked out;
• the IP address and browser details you started checkout from, and the identifiers stored in Meta's cookies, if your browser had them.

Before your email, name, phone, location details and account ID leave our server, each one is scrambled with a one-way hash (SHA-256), so the readable values aren't sent. Meta compares these hashes with ones it makes from its own users' details to match the purchase to a Facebook or Instagram account, so hashing does not make them anonymous to Meta. Your IP address, browser details and Meta's cookie identifiers are sent as they are, because that's the form Meta requires. To be able to send them after you pay, we save them with your Stripe checkout session when you start checkout.

Meta handles this data under its own privacy policy.

To protect accounts from password guessing, we briefly keep a note of your IP address in memory when you sign in, create an account or request a password reset. It isn't saved.

Emails you send us

If you email us, we keep the conversation so we can help you and follow up.

Cookies and browser storage

Our site uses these cookies:

• Sign-in cookie. Set by us, only if you sign in. Keeps you signed in to your account. It lasts up to 30 days, or until you sign out.
• Meta Pixel cookies. Set by Meta's pixel script, for example _fbp (an ID for your browser) and, if you arrived by clicking one of our ads on Meta, _fbc (an ID for that click). They let Meta link your visits and purchases here to its ads. We also read them when you start checkout, so we can include them in the purchase report we send Meta. Meta decides how long they last.
• Google Analytics cookies. Set by Google's analytics script, for example _ga and _ga_Z82N7SV69K. They let Google Analytics tell repeat visits from new ones. By default they last up to two years.

Your cart isn't a cookie. It's saved in your own browser's storage so it's still there when you come back, and it's cleared from this browser when you sign out. After you place an order, we also note your checkout reference in your browser's session storage, so refreshing the confirmation page doesn't count the order twice. Your browser clears it when you close the tab. Our Plausible analytics uses no cookies at all. Stripe's checkout page is run by Stripe and may use its own cookies, for example to prevent fraud, under Stripe's privacy policy.

How we use your information

• to process, ship and support your orders, including returns and refunds;
• to run your account: signing you in, saving your address, wishlist and cart, and showing your orders;
• to send account emails, such as confirming your email address and resetting your password;
• to answer your questions when you contact us;
• to keep the site and your account secure;
• to understand, in aggregate, how the site is used so we can improve it, using Plausible and Google Analytics;
• to measure and improve our ads on Meta (Facebook and Instagram), and to help Meta show them to people likely to be interested, using the Meta Pixel and Conversions API described above.

We don't send marketing emails.

Who we share it with

We share your information only with the services that help us run and advertise the shop:

• Stripe processes payments. It receives your payment details, email address and shipping address directly when you check out. We also store your IP address, browser details and Meta cookie identifiers with your Stripe checkout session (see “Meta (Facebook) Pixel and Conversions API” above).
• Meta Platforms receives what's described under “Meta (Facebook) Pixel and Conversions API” above: your browsing on our site through the pixel, and the hashed contact details and order details our server sends when you buy.
• Google receives what's described under “Google Analytics” above, so it can give us reports on how the site is used.
• Resend delivers our account emails, so it receives your email address and the message we're sending.
• The shipping carrier delivering your parcel sees the name and address on the label.

Of the services above, Meta is the only one we share your information with for advertising. It receives your activity on our site and details of your purchases so it can measure our ads and help show them to people likely to be interested. We don't sell your information for money or rent it out, but some US state laws may treat this as “sharing” your information (see US privacy rights below). Our Plausible analytics runs on our own server, so that data isn't shared with anyone. We don't give your information to anyone not listed above unless the law requires us to.

How long we keep it

We keep your account information for as long as you have an account. We keep order records for as long as we need them to support your order and to meet tax and accounting obligations. Sign-in sessions expire after 30 days, and email confirmation and password-reset links expire after a few days and one hour respectively. When we no longer need information, we delete it.

Your rights and choices

• Access and correction. You can see and update your name, email, phone and shipping address in your account, along with your orders and wishlist. For a copy of anything else we hold about you, just ask.
• Deletion. You can ask us to delete your account and the personal information linked to it. We may need to keep some order records where the law requires it.

To make a request, email us at brandon@reverbcrystals.com from the address on your account (or the one you used for your order) so we can confirm it's you.

Ads and analytics choices

You can block or delete cookies in your browser settings, and many browsers and extensions can block the Meta Pixel and Google Analytics. Our site still works if they're blocked. Google offers a browser add-on to opt out of Google Analytics, and Meta lets you manage how it uses your activity for ads in your Facebook and Instagram settings. Blocking the pixel in your browser doesn't stop the purchase report our server sends Meta when you place an order.

US privacy rights

If you live in California or another US state with a consumer privacy law, you may have the right to know what personal information we collect and how we use and share it (which this policy sets out), to get a copy of it, to correct it, and to have it deleted. You can use these rights by emailing us, as described above.

Under California law and similar laws in other states, giving Meta your activity on our site and details of your purchases for advertising, as we do through the Meta Pixel and Conversions API, may count as “sharing” personal information for cross-context behavioral advertising (ads chosen using your activity across different businesses' websites and apps). Those laws give you the right to opt out of that sharing.

Keeping your information safe

Our site uses HTTPS, passwords are stored only as hashes, and email confirmation and password-reset links work only once and expire. No system is perfectly secure, but we take reasonable steps to protect what you share with us.

Children

Our site isn't directed at children under 13, and we don't knowingly collect information from them. If you believe a child has given us their information, contact us and we'll delete it.

Changes to this policy

We may update this policy from time to time, for example if we add a new feature or service. When we do, we'll change the “Last updated” date at the top of this page.

Contact us

Questions about this policy or your information? Email us at brandon@reverbcrystals.com.