Privacy policy
This explains what we collect, who we share it with, and what you can tell us to stop doing. We sell only within the United States, so this is written around US privacy law.
What we collect
- Order information — your name, email address, delivery address and, if you give it, your phone number.
- Payment information — handled entirely by PayPal. Card and account details are entered on PayPal's side and never reach our servers.
- Marketing preferences — whether you asked to receive email from us, and when.
- Technical data — IP address, browser and device type, pages viewed, and the site that referred you.
What we do with it
- Take payment, pack your box and get it to you
- Answer your questions and provide support
- Send marketing email, only if you asked for it, and only until you tell us to stop
- Measure how the site is used so we can improve it
- Detect and prevent fraud
Cookies and tracking
These are the cookies this site actually uses. Nothing else is set by us.
Strictly necessary
tribeca_session— keeps your box and your signed-in state. Expires when you close your browser.esb_ref— records which affiliate sent you, so we can pay them commission if you buy.
How we know where you came from
esb_referrer,esb_landing,esb_utm_*— the site that referred you, the page you arrived on, and any campaign tags in the link._fbc,_fbp— set if you arrive from a Facebook or Instagram link, so we can tell whether an ad led to a sale.
Analytics
- Google Analytics (
_ga,_ga_*) — how many people visit, which pages they read, and what they buy.
Advertising
- Google Ads (
_gcl_auand Google's advertising cookies) — tells us when one of our ads led to an order, and lets us show our ads again to people who have visited this site (remarketing). Google receives the pages you view and, when you order, the order number and total, never your name, email or address. - Meta (Facebook & Instagram) pixel (
_fbp,_fbc) — tells us when an ad on Facebook or Instagram led to an order, and lets us show our ads to people who have visited this site. Meta receives the pages you view and, when you order, the order total, never your name, email or address. - Microsoft Advertising (
_uetsid,_uetvid,MUID) — the same for ads on Bing and Microsoft's partner sites. Microsoft receives the pages you view and, when you order, the order number and total, never your name, email or address.
If your browser sends a Global Privacy Control or Do Not Track signal, none of these tags load at all. You can also turn off personalised ads from Google at adssettings.google.com and from Microsoft at account.microsoft.com/privacy/ad-settings.
PayPal sets its own cookies when you pay, to process the payment and detect fraud.
You can refuse cookies in your browser settings. The strictly necessary ones above will stop working if you do, which mainly means your box will not survive between pages. You can also opt out of Google Analytics with Google's browser add-on.
Who we share it with
We do not sell your personal information. We share it only with:
- PayPal — to take your payment and detect fraud
- Our fulfilment and inventory provider — receives your name, delivery address and order contents so the box can be picked, packed and dispatched
- Shipping carriers — USPS, UPS or FedEx, to deliver the parcel
- Google — usage data through Google Analytics, and through Google Ads the pages you visit and your order number and total, to measure and target our ads
- Meta — through the Meta pixel, the pages you visit and your order total, to measure and target our ads on Facebook and Instagram
- Microsoft — through Microsoft Advertising, the pages you visit and your order number and total, to measure and target our ads
- Government authorities — where the law requires it
How long we keep it
Order records are kept as long as tax and accounting rules require. Marketing preferences are kept until you unsubscribe. Server logs are kept briefly and then discarded.
Your choices
Every marketing email has an unsubscribe link and it works immediately. You can ask us what we hold about you, ask us to correct it, or ask us to delete it — email us and we will respond. We cannot delete records we are legally required to keep, such as completed orders, and we will say so if that applies.
Children
This site is not directed at children and we do not knowingly collect information from anyone under 13.
Changes
If this policy changes we will update the date at the top.