What we keep. What we don't.

This policy covers deathchains.com, operated by Death Chains LLC, a California limited liability company (“Death Chain,” “we,” “us”). Questions or requests: support@deathchains.com.

What we collect

• When you order: your name, email, phone number, shipping and billing address, and what you bought. Payments are processed by Stripe; card numbers go straight to Stripe and never touch our servers.
• When you join the list: your email address, when and where you signed up, and the welcome code issued to you.
• When you contact us or leave a review: what you send us: name, email, order number, message, rating and review text.
• To stop fraud and abuse: we use your IP address briefly to rate-limit requests. With each order, sign-up or message we keep a keyed hash of it (not the address itself), and with orders we also keep your browser type, the site and campaign that sent you, and that day's anonymous visit code, so we can spot fraud and see which pages lead to sales.
• Technical logs: our host and our app keep standard server and error logs for security and troubleshooting.
• When you browse: pages viewed, the site that referred you (its domain, not the full address), device and browser type, and campaign tags in the link you followed. Our own analytics are cookieless: your IP address is combined with a random value that's replaced every day and stored only as a one-way hash, so we can count visits without knowing who you are.

How we use it

• To take payment, ship your order, send order and shipping emails, and handle returns.
• To answer you when you write to us.
• To send marketing email if you asked for it. Every one has an unsubscribe link.
• To keep the site secure, prevent fraud and abuse, and understand what's working so we can improve it.
• To meet legal, tax and accounting obligations.

If you're in the EU or UK, our legal bases are: performing our contract with you (orders), your consent (marketing email, analytics and marketing cookies), our legitimate interests (security, fraud prevention, cookieless site statistics), and legal obligations (tax records).

Who we share it with

Only the service providers that run the store for us, and only what each one needs:

• Stripe — payment processing, fraud screening and receipts.
• Hostinger — website hosting, database and email delivery.
• Shipping carriers — your name and address to deliver the package.
• Google Analytics — site measurement. Before you choose, Google gets only cookieless signals under Consent Mode (no cookies, no identifiers); full measurement starts only if you accept analytics cookies. Google Merchant Center receives product information only, never customer data.
• Advertising platforms (such as Meta or TikTok) — only if we turn them on, and only after you accept marketing cookies.
• Professional advisers, and authorities when the law requires it.

We do not sell your personal information, and we don't share it for cross-context behavioral advertising unless you opt in to marketing cookies.

Cookies and similar storage

• Essential (always on): your browser's local storage keeps your bag, your welcome code, recently viewed pieces, your cookie choices and whether you've seen the sign-up pop-up. Campaign tags from the link you arrived on are kept for that browser tab only if you allow analytics. Staff sign-ins use a secure session cookie.
• Analytics (opt-in): Google Analytics cookies. Until you accept, Google receives only cookieless signals under Google Consent Mode.
• Marketing (opt-in): advertising pixels, if enabled.

We honor the Global Privacy Control signal: if your browser sends it, marketing stays off. Change your cookie choices at any time. We don't respond to Do Not Track signals, which have no common standard; we do honor Global Privacy Control.

How long we keep it

• Order and payment records: 7 years, for tax law.
• Email list: until you unsubscribe. After that we keep only your address, marked unsubscribed, so you're never emailed again, unless you ask us to delete it entirely.
• Messages to us: up to 2 years, then deleted automatically.
• Our cookieless analytics events: 13 months, then deleted automatically.
• Google Analytics data: 14 months (Google's retention setting).
• Our app's technical logs: 90 days.

Your rights

• California (CCPA/CPRA): you can ask what we hold about you, get a copy, correct it, delete it, and opt out of any sale or sharing (we don't sell it; we share it for ads only if you turn on marketing cookies, and never when your browser sends Global Privacy Control). We don't collect sensitive personal information, and we won't treat you differently for using your rights.
• EU/UK (GDPR): access, correction, deletion, restriction, portability, objection, and the right to complain to your data protection authority.
• Everyone: unsubscribe from marketing email at any time.

To use any of these, email support@deathchains.com from the address on your order or subscription so we can verify it's you. We answer within 30 days (45 days for California requests, as the law allows). You can use an authorized agent if you give them written permission.

Security

The site runs on HTTPS. Staff accounts use strong hashed passwords and support two-factor authentication, access is logged, and we keep only what we need. No system is perfectly secure; if something goes wrong that affects you, we'll tell you as the law requires.

Where it's processed

We're based in the United States, and our providers may process data in the US and other countries. Where EU/UK data leaves those regions, our providers use recognized safeguards such as Standard Contractual Clauses.

Children

Death Chain isn't directed at anyone under 18, and we don't knowingly collect their data. If you think we have, email us and we'll delete it.

Changes

If we change this policy, we'll update the date above. Significant changes will be called out on the site or by email.