Legal
Privacy Policy
Last updated
The short version
Placing an order gives us your name, email, shipping address and what you bought; your card details go straight to Stripe and never reach our servers. Two contact forms send us what you type into them. One analytics tool counts pages and taps. A hat in the shop bag stays in your own browser until you check out. There is no customer account, and we don’t sell any of it.
What you send us on purpose
Two forms on this site send us anything, and both only when you submit them.
The contact form collects your name, email address, a phone number if you choose to give one, the topic you picked, and your message. The opening list on a location page that has not opened yet collects your email address and which neighbourhood you asked about.
Both are delivered by Web3Forms, a form-relay service that turns the submission into an email and sends it to us. It is a pass-through: the message lands in our inbox at chris@chrisneddys.com, and we answer it from there. We keep that correspondence for as long as it is useful to have answered you, and you can ask us to delete it at any time.
What placing an order collects
When you buy something from the shop, Stripe Checkout collects your name, email address, your shipping address if you have it shipped, and a phone number — Stripe requires it to check out, and we only use it for questions about your order. It hands that back to us along with what you bought and, for a numbered item like the Foam Trucker, which edition number your order was assigned.
Your card details never reach us. You type them into Stripe’s own checkout page, not ours, and our server only ever gets back a payment confirmation — never a card number.
Who order information goes to
Placing an order shares what it takes to fill it with:
- Stripe — to take payment and, where it applies, to calculate tax.
- The shipping carrier — your name and address, to deliver an order you have shipped. Nothing is shared with a carrier for a pickup order.
- Vercel — hosts this site and the server that talks to Stripe.
- Neon — the Postgres database your order is stored in.
- Resend — sends the order-confirmation and order-status emails.
Each of those only sees what it needs to do its one job. None of them are ours to speak for beyond that — see their own privacy policies for how they handle it on their end.
How long we keep order records
We keep an order’s record for as long as we need it — to fulfil it, to handle a return, and because tax law requires a business to keep sales records. We don’t hold onto it longer than that on purpose.
What gets measured automatically
We use two analytics tools to understand which pages people read and which buttons they press — how many, not who.
- Google Analytics 4, which sets cookies and records the pages you visit, roughly where in the world you are, and the kind of device and browser you used.
- Vercel Web Analytics, from the company that hosts this site, which sets no cookies and counts page views, the country you are in, and the kind of device and browser you used.
Alongside page views, Google Analytics receives a named event when you do one of a fixed set of things: tap an order, delivery, phone or directions link; open an item on the menu; view a product, add one to the bag, or open the bag; send the contact form; or join an opening list. An event carries what was tapped and which part of the page it was tapped from.
An analytics event never carries your name, email address, phone number, message or anything from an order. When a form fails, the event says only why — a fixed word like network or rejected — and never what you had typed. This is deliberate and it is enforced in the code, not by policy.
What stays in your browser
Before you check out, whatever is in the shop bag — the item and the quantity — lives only in your own browser’s local storage, so the bag survives a reload. It is never sent to us or to anyone else while you’re still building it. Clearing your site data empties it. Once you start checkout, the items you’re buying leave the browser and become the order information described above.
Cookies
This site sets one cookie of its own: a sign-in cookie for the small team that runs the store, set only when one of us signs in at /admin to manage products and orders. Customers never get this cookie — there is no customer account to sign into, and checking out doesn’t set one either. Beyond that, the only cookies here are Google Analytics’. We set no advertising cookie, and nothing here follows you to other sites. Blocking cookies, or blocking analytics outright, costs a customer nothing on this site — every page, the menu, both forms and checkout work exactly the same.
When you leave this site
Food ordering, delivery and our social links hand you to companies that are not us, each with its own privacy policy and none of which we control: Otter for pickup orders, DoorDash, Uber Eats and Grubhub for delivery, ezCater for catering, and Instagram, Yelp and Tripadvisor elsewhere. Anything you type once you are there — an address, a card number, a tip — you are giving to them, not to us. We never see it. Checking out through the shop is different: that payment page is Stripe’s, described above, and it is the one place off this site we do ask you to visit to complete a purchase.
What we do not do
- We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising.
- We do not run ads on this site or build an advertising profile of you.
- Customers don’t have accounts — checking out never asks you to create one. The only sign-in on this site is for the owners who run the store.
- We never see or store your card number — Stripe takes payment directly.
Your choices
You can opt out of Google Analytics everywhere with Google’s browser add-on, or block both tools with any content blocker. Clearing your site data removes the analytics cookies and empties the shop bag.
If you are a California resident, the CCPA gives you the right to know what personal information we have collected about you, to have it deleted, to have it corrected, and not to be treated differently for asking. Write to chris@chrisneddys.com and we will handle it — including a request about an order’s information, not just a form submission. We will not ask you to create an account to make a request; checking out doesn’t create one either.
In practice the personal information we hold is whatever you sent us through one of the two forms, or through an order you placed, so “delete my data” means deleting that — subject to what tax and accounting law requires us to keep a record of for a completed sale.
Children
This is a restaurant website, not a service for children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us something through a form or placed an order, email us and we will delete it.
Changes
If this policy changes, the date at the top of the page changes with it. There is no mailing list to be notified through, because we do not keep one.
Contact
Questions about any of this, a request about your own data, or a question about an order go to the same place: