Privacy policy.

Last updated October 27, 2026

What we collect

Almost everything we hold is information you type into the checkout form. We do not buy data about you, and we do not build a profile from browsing alone.

When you place an order

• First and last name.
• Email address.
• Phone number.
• Billing address, and a separate shipping address if you choose to ship somewhere else.
• Order contents: the strains, weights, quantities, unit prices and totals, plus the shipping method you picked.
• Any note you add to the order, and any discount code you enter.
• Whether you ticked the newsletter box.

While you shop, before you place an order

Unless you declined the cookie notice, we keep a record of your bag: the products, sizes and quantities in it, how far you got (bag, checkout, payment page) and when it last changed. It is filed under a random id kept in your browser, not under your name. If you type your email address and first name at checkout, they are added to that record as soon as you enter them, even if you do not place the order. We use this to see where orders are left unfinished and, at most once per bag, to send you a reminder with a link that puts the products back in your bag. Reply to that email and we will not send another.

When you create or use an account

Checkout creates an account for the email address on the order so the order can be looked up later. The account holds your email address and your name. Passwords are handled by our authentication provider and are never visible to us.

When you subscribe to the newsletter

Your email address, which form you subscribed from, your subscription status and an unsubscribe token. Nothing else.

Automatically, when you use the site

• Your IP address, used to rate-limit payment attempts. It is stored as part of a counter key with an attempt count and a time window.
• Your browser's user agent and IP address are included in the purchase event sent to Meta, if that integration is enabled — see Analytics below.

Card details

If you pay with cryptocurrency instead, you are redirected to a hosted payment gateway and complete the payment there. We never see a wallet or card credential in that flow either — we receive a payment token and, once the payment confirms, a transaction hash.

Where it is stored and who processes it

Supabase

Our database and our authentication provider. Customer records, orders, order items, newsletter subscribers, email logs and rate-limit counters are all stored there.

Payment processors

Card payments are authorised by our card processor; crypto payments go through a hosted crypto gateway. Each receives the details it needs to take the payment, including your name, email, phone, billing address and the order total.

Resend

Sends our transactional email: order confirmations, shipping confirmations and the newsletter welcome. It receives your email address and the contents of the message.

Cloudflare Turnstile

Bot protection on card checkout. Your browser solves a challenge and we send the resulting token, together with your IP address, to Cloudflare to verify. Turnstile is not used on the crypto checkout.

We also keep a log of every transactional email we send: the order it relates to, the recipient address, the message type, whether it sent, and the provider's message id. That log is what stops you receiving the same confirmation twice.

Analytics and advertising

Three integrations are optional and only run when they are configured. None is required for the site to work.

• Meta. A browser pixel tracks page views and checkout events. Separately, when an order is paid, our server sends a purchase event to Meta's Conversions API containing your email address hashed with SHA-256, your IP address, your user agent, the Meta cookies _fbp and _fbc if your browser has them, the order id, the product slugs in the order, the item count and the order total. The email address is hashed before it leaves our server; the plain address is not sent.
• Google Analytics. A standard gtag measurement snippet. If no measurement id is configured, the snippet does not render at all.
• Matomo. Page views and the links you follow, measured on a Matomo server we use (analytics.spacewalk.cloud) rather than a large ad network. It sees your IP address, browser and the pages you visit. If you decline, we still count your visit anonymously, without cookies: Matomo deletes its cookies, sets no new ones and stores your IP address shortened, so the visit cannot be tied back to you or to your other visits.

Cookies and local storage

sb-access-token

Your session token. Set when you sign in or when checkout creates your account. HTTP-only, SameSite=Lax, expires after one hour and is renewed silently while you are signed in.

sb-refresh-token

Used to renew the session above without asking you to sign in again. HTTP-only, SameSite=Lax, expires after 30 days. Signing out deletes both cookies.

_fbp and _fbc

Set by the Meta pixel, if it is enabled. We do not set them ourselves; we read them only to attach to the purchase event.

_pk_id and _pk_ses

Set by Matomo, if it is enabled: an anonymous visitor id (kept up to 13 months) and the current visit (30 minutes). Not set, or deleted, if you declined the cookie notice.

js-cart-v2

Not a cookie. Your cart is kept in your browser's local storage under this key so it survives a page reload. Clearing site data empties your cart. Its contents are also reported to us as they change, as described under "While you shop", unless you declined the cookie notice.

js-cart-id

Not a cookie. The random id your bag record is filed under (see "While you shop"). Replaced with a new one once your bag becomes an order. Not set if you declined the cookie notice.

How long we keep it

• Orders and order items are kept as business and tax records for as long as we are required to hold them.
• Customer records are kept while the account exists.
• Newsletter subscribers are kept until you unsubscribe. Every newsletter email carries an unsubscribe link.
• Rate-limit counters and checkout security recordsare short-lived and cleared automatically.
• Email logs are kept alongside the order they relate to.
• Bag records that never became an order are deleted after 90 days.

Deleting your data

You can delete your account from your account page. Doing so removes your authentication user and your customer record. Orders survive that deletion with the customer link removed, because we are required to keep sale records.

For anything else — a copy of what we hold, a correction, or a deletion request that goes beyond the account itself — emailorders@jupiterskywellness.comfrom the address on the order. We will tell you what we hold, what we can remove, and what we are obliged to keep and for how long.

Your rights

Privacy law varies by where you live, and we are not going to claim a certification we do not hold. In practice, and regardless of your location, you can ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete what we are not required to keep, and unsubscribe from marketing email at any time. Use the contact address above and we will respond.

Security

Session cookies are HTTP-only and are marked secure over HTTPS. Database access runs server-side only; the credentials never reach your browser. Card checkout is protected by bot verification and by per-IP rate limiting, and duplicate submissions are blocked so a double-click cannot charge you twice. No system is immune, and we do not claim otherwise.

Age

This site is for adults 19 and over. We do not knowingly collect information from anyone under that age. If you believe we have, email the address above and we will remove it.

Changes to this policy

When this policy changes, the date at the top changes with it. We do not maintain a version history, so if a specific wording matters to you, keep your own copy.

Contact

Privacy questions and requests go toorders@jupiterskywellness.com