Privacy.

Shop Xtalgic is operated by Xtalgic Media Works LLC. This page explains how we use information when you browse, subscribe, or place an order.

Orders, checkout, and support

We use contact information, shipping addresses, selected items, prices, payment and refund references, payment status, and correspondence to process orders, recover interrupted payments, provide support, arrange shipping, and maintain business and tax records. Checkout attempts may retain item and shipping details even if a purchase is not completed. We do not store your full payment card number.

PayPal processes payments, including Apple Pay when available. Payment components can connect to PayPal, and to Apple on eligible devices, when the storefront loads before you start checkout. These providers may process IP addresses, device information, and browser storage under their own privacy policies. Our optional shop analytics setting does not disable payment services.

Email requests

We use Resend to deliver order and shipping emails, signup confirmations, confirmation reminders, and updates you request. Launch and restock requests record your email address, consent, confirmation details, and requested updates or products. We also retain message contents and delivery records. Launch signups may include a referral source and campaign supplied with the signup, including when optional shop analytics are off. You can unsubscribe from requested updates using the links in those emails. Unsubscribing does not stop emails needed to service an order or automatically delete earlier records. See our launch-list and restock notices.

Cookies and browser storage

We use local storage to remember your cart, shipping state, selected body style and kit, and analytics preference. Body style and kit selections stop being restored after 24 hours. Cart, shipping-state, and analytics preferences have no fixed application expiry and may remain until changed or cleared. Session storage supports checkout recovery and groups analytics activity within a visit. Email confirmation may set a verification cookie lasting up to 90 days.

Our hosting, security, and payment providers may also use cookies or similar technologies. Clearing browser data removes saved local preferences and may interrupt checkout recovery. It does not delete records already held by us or our providers.

Shop analytics and your choice

Our first-party analytics measure visits, mobile or desktop usage, referral sources and campaigns, kit selections, gallery and video interactions, cart activity, checkout starts, cancellations and errors, signups, and purchases. Events include timestamps and may include payment-method and error-category labels. A random session identifier groups activity within a visit and refreshes after 30 minutes of inactivity. We may link a session to a signup or order to measure conversions; this information is not fully anonymous.

Optional storefront analytics are on by default unless you have saved an opt-out or your browser reports a Do Not Track or Global Privacy Control signal that the storefront recognizes. Our storefront checks these browser signals and the saved preference before sending optional shop events or supplying a new checkout analytics session. You can turn optional shop analytics off below without affecting shopping or checkout.

Our analytics records use referring-site hostnames rather than full referring-page URLs, along with supplied campaign labels. They do not store raw IP addresses. We have not configured advertising pixels in the storefront, and we do not sell our customer or subscriber lists.

Hosting, security, and reporting

The store uses OpenAI’s ChatGPT Sites hosting and connected administration tools, with Cloudflare infrastructure for serving the site and storing application records. Hosting and security logs can include IP addresses, browser headers, request URLs, timestamps, and errors, separately from our optional shop analytics. We process IP-derived hashes and email-based rate limits to prevent abuse; our application does not retain raw IP addresses in those rate-limit records.

We use ChatGPT and connected reporting tools to administer the store, review operations, and analyze performance. The dedicated daily analytics report returns aggregate totals rather than names, email addresses, order IDs, or session IDs. Other authorized administrative tools can access customer and order records when needed for store operations. These tools are restricted to authorized access and are not public customer reports.

Videos, fonts, and external services

Our background and product videos are served by our hosting service. The YouTube guide player loads only when you choose to open a video and uses YouTube’s privacy-enhanced mode. Opening that player connects to YouTube, which may process information or use browser storage under its own policies; privacy-enhanced mode does not mean no information is shared.

The storefront loads fonts from Google Fonts when the page opens, independently of the shop analytics preference. Requests to external services can disclose connection and browser information, such as an IP address and browser headers. External links and provider services have their own privacy practices.

Sharing and retention

We provide information to services needed for hosting, administration and reporting, payment processing, email delivery, shipping labels and carriers, and support. We may also disclose information when required by law. Provider-held records and backups are subject to the relevant provider’s retention practices.

We retain records for order fulfillment, payment recovery, customer support, requested emails, security, business reporting, and legal or tax obligations. There is currently no fixed automatic deletion schedule for stored analytics, session-to-order links, checkout-attempt snapshots, or email payloads. Session expiry, an expired checkout reservation, or unsubscribing does not automatically delete those records. Expired rate-limit entries are cleaned up during checkout activity; email suppression records may be retained to prevent unwanted messages.

Privacy requests

Contact orders@shopxtalgic.com to ask about our practices or request access to, correction of, or deletion of your information. Depending on applicable law, you may have additional privacy rights. We may need to verify a request and retain certain information for legal obligations, transaction disputes, security, or suppression of unwanted emails. Please do not send payment-card details with a privacy request. We will update this page when our practices change.