Privacy

Merch orders

When you check out we keep your email, the name you give for pickup, your phone number if you add one, what you ordered and what you paid. We use them to prepare your order, to email you the confirmation and the ready-for-pickup notice, and to check your pickup code at the table. Pickup only: we never ask for a home address.

Card payments are taken by Stripe inside the checkout page. Your card details go straight to Stripe; the team never sees or stores them. We keep Stripe's payment reference so a refund can be matched to your order.

Orders stay in the team's records, under the email used, including after an account is deleted, so the team can answer questions about them and keep its accounts.

Accounts

An account is optional. It holds your name, your email and a password (stored by our database provider, Supabase, as a one-way hash, never as the password itself). Orders placed with your account's email show in it once you confirm the email.

You can change your name, email and password, sign out on every device, or delete your account on the Login & Security page. Deleting removes your login; your past orders stay as described above.

Cookies and storage

The store uses only what it needs to work:

• Your bag is kept in your browser's local storage. A wfr_cart cookie (30 days) names the stock hold for your bag, so the items you add are reserved for you while the timer runs.
• Your order: a wfr_order_access cookie (1 day) lets this device show the order you just placed.
• Signing in: Supabase's session cookies (names starting sb-) keep you signed in. A wfr_verify cookie (1 hour) remembers which email is waiting for confirmation.

None of these are used for advertising or shared with anyone else.

Visit counts without cookies

To know which pages are read and how the store is used, the site counts page views, the site you came from (its name only), product views, adds to bag and checkouts started, and which partner logos people click. It sets no cookie for this and stores nothing in your browser. Your IP address and browser details are turned into a code that changes every day and cannot be turned back; the IP address itself is never stored. Individual page views are deleted after 35 days, leaving daily totals; store events are kept for up to 400 days. Nothing is counted when your browser sends Do Not Track or Global Privacy Control.

Email

We email you only about your orders and your account (confirmation, ready for pickup, refunds, sign-in links). Those emails are sent through our email provider. Newsletters go only to the team's partners and contacts who agreed to them, and every newsletter has an unsubscribe link.

Your requests

To see what we hold about you, correct it, or ask us to delete it, email fsae.uwo@gmail.com from the address you used. Guest orders can be found with the order lookup.