Privacy

We collect what we need to send you a shirt and, if you make an account, to know it is you. Not more.

Where this applies

This page covers theoriginalcigarettestshirt.com, which is the store, and 100cigarettes.com, which is where the drops and the games live. Same owner. Same systems.

What we collect

When you place an order, we collect the details needed to fulfil it: your name, shipping address, email, order contents, and a phone number if checkout asks for one. Payment card details are entered into and processed by our payment providers. We never see or store your full card number.

When you give us your email for a drop alert, a price alert or the waitlist, we keep the email and what you asked to hear about.

When you make an account, we keep what is listed under Accounts below.

When you load a page, we count the visit. See Counting visits.

Who processes it

• Shopify runs the store and holds the order records for every drop. Drop 001 and Cigarettes 2 are paid through Shopify checkout. Shopify also stores the alert and waitlist sign-ups.
• Stripe takes payment for Cigarettes 3 and Cigarettes 4. Its checkout page collects your email, name, shipping address, phone number and card. We then pass your email, name, address, phone number and size to Shopify as a zero dollar order, so the shirt gets made.
• Apliiq prints and ships the shirts. It receives your name, shipping address, phone number if you gave one, and what you ordered, through Shopify. The carrier gets what is on the label.
• Resend delivers our email: sign-in codes, order notes, alerts and drop announcements. It receives your email address and the message.
• Upstash hosts our database: accounts, scores, leaderboards, visit counts, and a Cigarettes 4 sales ledger that includes the buyer's email. The ASMR leaderboard is stored by email.
• HubSpot holds the mailing list: your email, the display name you typed on the ASMR board if that is how you joined, which alerts you asked for, whether you unsubscribed, and a log of emails delivered to you or bounced, with their subject lines.
• Google is involved only if you choose to sign in with Google. It tells us your email address and name.
• Vercel hosts both sites and runs page analytics on them. It sees standard request data such as your IP address, your browser and the page you asked for.
• CoinGecko and Coinbase are asked for the price of bitcoin directly from your browser on the Cigarettes 2 page. They see a standard request. We send them nothing about you.

Each of these providers processes data under its own privacy terms.

How we use it

To take payment, print and ship your order, send order and tracking emails, handle exchanges, sign you in, run the leaderboards, and keep our tax and accounting records. We do not sell your personal information.

The mailing list

Drop announcements go to people who signed up for them and to people who have bought a shirt. Joining the ASMR leaderboard with your email also puts you on the list. Making an account does not.

Drop announcements and alerts carry an unsubscribe link. One click and it stops. The emails may record whether they were opened or clicked.

What is public

• The registers show a shirt number, the price paid and the date for shirts sold. On the Cigarettes 2 and Cigarettes 3 registers a name appears only if you chose one and ticked the box. Otherwise the row says Anonymous. On the Drop 001 register a name appears only if someone entered the checkout email for that shirt and typed one.
• The ASMR leaderboard shows the display name you typed and your score. It does not show your email.
• Account handles and scores will appear on leaderboards when those open. See below.

Accounts on 100cigarettes.com

An account is optional. You never need one to buy a shirt.

If you make one, it holds:

• your email address
• your name, if you give it or if Google does
• the public handle you choose
• your shirt size, only if you give it
• your game scores
• a record of what you have found and done on the site
• a record of purchases, matched to the account by the email you verified

Your handle and scores will be public on leaderboards when those open. Nothing else in the account will be. Your email, name and size are shown only to you. Game scores are reported by your own browser.

We sign you in with a one-time code sent to your email, or with Google where that is offered. We never have a password for you. Sign-in requests are rate limited by IP address for an hour and by email address for a day. Those counters expire on their own.

Your browser keeps a sign-in token in its local storage, not a cookie. A session lasts 90 days from the last time you used it. Sign out ends the session on that browser.

To delete your account, email us from the address on the account. Where to write is under Contact. We remove your profile, handle, scores and record from our database. It cannot be undone.

Deleting your account does not remove:

• orders and payment records held by Shopify and Stripe, or our own sales ledger of them.
• your place on the mailing list. The unsubscribe link in a drop announcement or alert does that.
• the delivery logs our email provider keeps of messages already sent.
• your ASMR leaderboard entry. It is stored by email, apart from the account. Ask in the same email and we remove it too.

Counting visits

We count page views ourselves, using a random id kept in your browser's local storage. It records the page and where you came from. It is not joined to an account, an email or an order. The games send anonymous play events the same way. Vercel's analytics script also runs on the pages.

One page tells you the city your connection appears to come from. That comes from Vercel's request headers. We do not store it.

Cookies

We set no cookies of our own. The store page loads Shopify's buy button and checkout, which may set cookies necessary for the cart and checkout to function. Stripe's checkout page may set its own.

Your choices

You can ask us for a copy of your data or ask us to delete it, subject to the order records we have to keep for tax and accounting. To delete an account, see Accounts above.

Contact

Email hello@theoriginalcigarettestshirt.com, or reply to your order confirmation.