We treat your data like a duck.

• Order info: name, shipping address, email, phone (optional), and the items you ordered.
• Payment info: processed by Stripe. We never see or store your card number.
• Waitlist signup: email and optional US cell number plus SMS opt-in consent (you tick a box).
• Analytics: aggregate page-visit data via Google Analytics 4 with IP anonymization. No personal IDs.
• Cookies: session and preference cookies only. No third-party advertising cookies set without consent.

• Fulfill orders and ship boxes.
• Email you about your account: order confirmations, renewal reminders, support replies, drop announcements.
• Text you about your account (if you opted in): box-ship notifications, drop launch heads-up. Up to about 4 messages per year.
• Improve the site — understand what pages people find useful.

• We don't sell or rent your data. Ever. Period.
• We don't share your address with anyone except our shipping carrier and 3PL fulfillment partner.
• We don't run retargeting ads using your data.
• We don't spam. We email when we have something real to say.

You can request your data, correct it, or delete it any time at hello@duckcrate.com. California (CCPA), Virginia (VCDPA), and EU (GDPR) residents have explicit data-portability and deletion rights — same email works. We respond within 30 days, usually within 48 hours.

If you opted in to SMS notifications, you agreed to receive about 4 messages per year from DuckCrate — box-ship notifications and drop launch heads-up. Message and data rates apply. Reply STOP to any text to opt out instantly. Reply HELP for help.

Carriers are not liable for delayed or undelivered messages. We don't share phone numbers with third parties for marketing.