Privacy

• Orders. Your name, email, shipping address, what you bought, and the amounts. Card details go straight to Stripe; we never receive or store your card number.
• Accounts. If you sign in to the Custom Studio: your email address, the designs you make, the descriptions you typed to make them, and how many designs you have left. Sign-in is by an emailed link, so there is no password to store.
• First-responder verification. Verification is carried out by VerifyPass. We receive and keep the confirmation they send us — the email you verified with, the group you qualified under, and the reference for that verification. We do not receive your ID or supporting documents.
• Department requests. The agency name, your name and rank, your official email, what you asked for, and any purchase order or authorization letter you upload.
• Messages. What you send through the contact form, and your reply address.
• Technical data. Standard server logs, and a one-way scrambled form of your IP address that we use only to limit abuse of checkout, uploads and forms.

To take payment, make and ship your order, send you the receipt and tracking, answer you when you write, keep your designs and credits with your account, apply your verified discount, check that department artwork is authorized, prevent fraud and misuse, and meet our tax and record-keeping obligations. We do not use your information for advertising and we do not sell or rent it.

The emails we send are about your order or account. We do not add you to a marketing list unless you ask us to.

We use other companies to run the store. Each receives only what its job needs:

• Stripe — payments.
• Printful and Printify — print and ship your order, so they receive your name, address and the items. SinaLite does the same for department roll labels.
• VerifyPass — first-responder verification, under its own privacy policy.
• Supabase and Vercel — hosting and database for the site, your account and your order records.
• Resend — delivers our order and account emails.
• AI model providers — when you use the Custom Studio, your description and the resulting image are sent to image and safety-check models (reached through Vercel's AI Gateway) and to Replicate for background removal. Do not put personal details about yourself or anyone else in a design description.
• sed.sh — scans files uploaded with a department request for malware.

We also disclose information when the law requires it, or to protect against fraud or harm. If the business is ever sold or reorganized, order and account records may transfer with it under the same commitments.

We use only what the site needs to work: a sign-in cookie if you have an account, a cookie that remembers your first-responder verification in the browser you verified in, and storage on your own device for your shopping bag and an unfinished design draft. We do not use advertising or analytics trackers. If that changes, this page will say so first.

Order records are kept for as long as tax and accounting rules require. Account data, designs and credits are kept until you ask us to delete your account. Verification records are kept while your discount is active. Department authorization records are kept for the period needed to document that artwork was used with permission. Contact messages are kept as long as needed to resolve them.

You can ask to see, correct or delete the information we hold about you, and we will do it unless we are required to keep it (for example, a record of a sale). Send us a message from the email address on your order or account so we can confirm it is you. We do not treat you differently for making a request. Depending on where you live you may have additional rights under state privacy law, and we will honor them.

Payment details are handled entirely by Stripe. Order and account data is stored in access-controlled systems reachable only by our servers, uploads are held privately and scanned, and access to the back office is restricted. No system is perfectly secure; if something happens that affects your information, we will tell you.

The store is for adults. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, tell us and we will delete it.

If we change what we collect or who we share it with, we will update this page and its date before the change takes effect.