Privacy policy
This explains what we collect, who we share it with, and what you can tell us to stop doing. We sell only within the United States, so this is written around US privacy law.
What we collect
- Order information — your name, email address, delivery address and, if you give it, your phone number.
- Payment information — handled entirely by PayPal. Card and account details are entered on PayPal's side and never reach our servers.
- Marketing preferences — whether you asked to receive email from us, and when.
- Technical data — IP address, browser and device type, pages viewed, and the site that referred you.
What we do with it
- Take payment, pack your box and get it to you
- Answer your questions and provide support
- Send marketing email, only if you asked for it, and only until you tell us to stop
- Measure how the site is used so we can improve it
- Detect and prevent fraud
Cookies and tracking
These are the cookies this site actually uses. Nothing else is set by us.
Strictly necessary
tribeca_session— keeps your box and your signed-in state. Expires when you close your browser.esb_ref— records which affiliate sent you, so we can pay them commission if you buy.
How we know where you came from
esb_referrer,esb_landing,esb_utm_*— the site that referred you, the page you arrived on, and any campaign tags in the link._fbc,_fbp— set if you arrive from a Facebook or Instagram link, so we can tell whether an ad led to a sale.
Analytics
- Google Analytics (
_ga,_ga_*) — how many people visit, which pages they read, and what they buy.
PayPal sets its own cookies when you pay, to process the payment and detect fraud.
You can refuse cookies in your browser settings. The strictly necessary ones above will stop working if you do, which mainly means your box will not survive between pages. You can also opt out of Google Analytics with Google's browser add-on.
Who we share it with
We do not sell your personal information. We share it only with:
- PayPal — to take your payment and detect fraud
- Our fulfilment and inventory provider — receives your name, delivery address and order contents so the box can be picked, packed and dispatched
- Shipping carriers — USPS, UPS or FedEx, to deliver the parcel
- Google — analytics about your visit, as described above
- Government authorities — where the law requires it
How long we keep it
Order records are kept as long as tax and accounting rules require. Marketing preferences are kept until you unsubscribe. Server logs are kept briefly and then discarded.
Your choices
Every marketing email has an unsubscribe link and it works immediately. You can ask us what we hold about you, ask us to correct it, or ask us to delete it — email us and we will respond. We cannot delete records we are legally required to keep, such as completed orders, and we will say so if that applies.
Children
This site is not directed at children and we do not knowingly collect information from anyone under 13.
Changes
If this policy changes we will update the date at the top.