Privacy

The short version

We use your birth details to build your card, and for nothing else. We don't sell or share your data. Your typed-in details are deleted 90 days after delivery, and card PDFs are deleted after 30 days.

What we collect

• To make your card: the name you want printed, your birth date, and, if you give them, your birth time and birthplace.
• To deliver it: your email address. For gifts: your name, the recipient's name, your message, and, if you choose, the recipient's email and a send date.
• To run the shop: an order number, the order type, its status and timestamps, and where the visit came from (for example a link's tracking tag or the referring page).
• Payments: handled by Stripe. We receive confirmation that you paid, not your card number.

How long we keep it

• Your birth details and the other details you typed in are deleted 90 days after delivery. After that, the order record keeps only your sign, your numbers and the order status.
• Card PDFs are deleted from our storage 30 days after they're made. Keep your copy.
• Payment records are kept by Stripe as the law requires.

[Owner to confirm: how long email addresses and gift messages are kept, and how long the order record is kept.]

Who processes it

• Cloudflare hosts the site, runs the order system and stores card PDFs. Data may be processed in the United States.
• Stripe takes payments.
• Google Analytics counts visits and which pages and buttons are used, so we can see what works. It gets the page path and campaign tags only: never your name, birthday, birthplace, email or order details. Google sets its own cookies for this; you can block them with your browser or a tracker blocker and the site still works.
• Our mail server sends your card. Cards are sent from our own mail server ([email protected]).
• [Owner to confirm whether a birthplace is sent to any outside lookup service (for example a place-name or time-zone service), and to name it here.]

What we don't do

No selling or sharing of your data. No marketing emails unless you separately sign up for them. Your birth details, name and email are never sent to analytics. Buying a card gives us no permission to market to you.

The Midway Mailbag (email updates)

If you sign up for The Midway Mailbag, here is what happens to your details:

• What we store: your email address; your first name, region and the kinds of updates you picked, if you gave them; and a record of your consent: when you agreed, the wording you agreed to, and the page you signed up on.
• Double opt-in: we send one email with a confirm link. You're not on the list, and we send nothing else, until you click it. Unconfirmed signups are deleted. [Owner to confirm how long unconfirmed signups are kept.]
• What we send: fair, festival, midway and attraction updates, about twice a month in fair season and less in winter. Nothing about your card, and nothing from anyone else.
• Unsubscribe: every email has a one-click unsubscribe link, and we stop straight away.
• Deletion: ask us and we'll delete your Mailbag record entirely, not just mark it unsubscribed. [Owner to confirm the contact address for these requests.]
• Who sends it: The Midway Machine, Powell River, BC, Canada. [Owner to confirm mailing address.] [Owner to name the email service that sends the Mailbag.]

Signing up for the Mailbag is separate from buying a card. Buying a card never adds you to the list.

Your choices

You can ask us to see or delete your details at any time: reply to your order email. [Owner and legal review: PIPEDA, Quebec Law 25 and GDPR wording, contact details for privacy requests, and the 18+ rule.]