Last updated: May 22, 2026 · Peppu Studio LLC
When you create an account we collect your email address. Authentication is handled via magic links and Google sign-in (OAuth) — we do not store passwords. If you save profile information or place an order we may also collect your full name, phone number, shipping address, and order history (items, totals, payment method, fulfillment status). If you opt into our research community via Discord or Telegram we receive only the handle you choose to share.
We use your email and phone number solely to authenticate you, send order-related communications, and (if you opt in) deliver SMS / push restock alerts and infrequent campaign updates. We do not sell, rent, or share your data with third parties for marketing purposes. You may unsubscribe from marketing communications at any time via the link in every email or by replying STOP to any SMS.
When you provide a phone number at checkout or in the contact form, you consent to receive transactional SMS (order updates) and optional promotional SMS (drops, restocks). Reply STOP at any time to opt out of marketing SMS. Standard message and data rates may apply. Web push notifications are strictly opt-in via your browser and can be revoked at any time in browser settings.
We rely on the following processors to deliver the storefront. Each handles only the data necessary for its function:
• Supabase — account database, authentication, file storage.
• Vercel — hosting and edge delivery.
• Resend — transactional and marketing email delivery.
• Forward Email — inbound mailbox routing.
• Twilio — SMS delivery and two-way inbox.
• Payment providers — payment processing when a checkout rail is connected.
• Discord — research community and customer-service relay.
• Mux — video hosting for research content.
• Google — Sign-in (OAuth), Maps Places autocomplete for shipping addresses, and Google Analytics for basic storefront measurement.
• Microsoft Clarity — privacy-conscious session analytics and UX debugging.
We do not sell data. When measurement tags are enabled, Meta Pixel, Conversions API, Google tags, or a server-side tag gateway may receive limited checkout events such as add-to-cart, checkout progress, and confirmed purchase. These events are used for attribution, fraud review, performance, and storefront usability, and include deduplication IDs so browser and server events are not counted twice.
We use session cookies strictly for authentication. localStorage holds your cart contents, an anonymous session ID for the customer-service chatbot, and your stated preferences (theme, language). No advertising cookies. No cross-site tracking.
Customers who opt into our affiliate program receive a unique referral code. When that code is used at checkout, we record the referring affiliate ID against the order so we can pay the 33% cash commission once the order is delivered. Affiliates can view their referral count, pending commissions, and payout history inside their account. We do not share affiliate identities with referred buyers.
You have the right to access, correct, port, or delete your personal data at any time. To exercise any of these rights, email [email protected]from the email on file. We will respond within 30 days. California residents may opt out of any future "sale" or "sharing" of personal information at the same address (we do not currently sell or share for cross-context behavioral advertising).
Account and order data is retained as long as your account is active. Upon a verified deletion request, all personal data is permanently removed within 30 days, excluding records we are legally required to retain (tax invoices for 7 years, payment-processor audit logs per their retention schedule).
The storefront is restricted to users aged 21 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has provided personal information, email [email protected] and we will purge it immediately.
Data is processed in the United States. By using the storefront from outside the U.S. you consent to the transfer of your information to the U.S. for processing under U.S. law.
Privacy questions: [email protected]
General support: [email protected]