Privacy Policy

1. What we collect

When you submit our contact form, request a quote or place an order through checkout, we collect what you provide: name, email, organization, country, the items you ask about or order, quantities, dates, ship-to details and your message. International orders also collect a phone number, which customs may need. A quote request or an inquiry submitted through the contact form is stored as a record of its own, whether or not an order follows, and retained as a business record the same way a quote request is.

Accounts

An account is optional; guest checkout is unchanged and never requires one. If you create an account, we store your email address, your preferences, a referral code, your order history and your store-credit ledger entries. Your password is passed straight through to our authentication provider, which stores it hashed; we never store it ourselves.

Cookies and local storage

This site sets three cookies, all tied to the optional account system. bohr_session is essential, httpOnly (not readable by any script) and lasts about 30 days; it keeps you signed in between visits. bohr_auth is readable by the page and carries a boolean only, no token, no email and no id; it lets the page tell whether you are signed in without asking the server. bohr_recovery is set only if you follow an emailed password-reset link; it is httpOnly and lasts 15 minutes, just long enough to let you set a new password.

Your browser also keeps your cart, a few display preferences and any referral code you arrived with in local storage. That stays on your device — the cart reaches us only when you check out — and clearing your site data removes all of it.

2. Why we collect it

We use this information to answer your inquiry, to fulfill any order that follows, and, if you have an account, to operate it: signing you in, showing your order history and store credit, applying preferences, and crediting referrals. We do not send promotional email at present. If you opt in and we begin to, we will use your email address to send it, and you can opt out at any time from the unsubscribe link in any such message, from the Preferences form on your account page, or by contacting us. The unsubscribe link needs no sign-in and stops promotional email only; order and shipping messages are unaffected.

3. Third-party service providers

We share information with the following processors, and only as needed to provide their service: Stripe for payment processing, Supabase for authentication and the account database, and Resend for delivering account emails such as sign-up confirmation and password resets. The site and its API run on a DigitalOcean server. Every page also loads typefaces from Google Fonts, so Google receives your IP address when a page loads. When an order ships, we also share the details needed for delivery with carriers.

4. Data retention

Orders, store-credit ledger entries, quote requests and inquiries are business and financial records, and we keep them indefinitely. Deleting an account does not remove them; see Your rights below for what deletion does and does not erase.

5. Your rights

You may ask at any time to view, correct or delete the information we hold about you. Deleting an account erases your authentication-provider user record, replaces the email address on the account with a placeholder and clears your preferences. It does not erase the email address recorded against past orders, quote requests or inquiries, which we keep as business records; it retains your orders and ledger rows, forfeits any outstanding store credit, and leaves referrals you have already made vested for the referrer. Contact us if you want those remaining records erased too.

6. Contact us

Submit any privacy request through our contact form.