Privacy policy

Ski Scraper sells directly to consumers in the United States. This policy covers this website and the checkout that Shopify runs for us at shop.skiscraper.net.

The full company name, registered address and company number belong here and are outstanding. This page is not complete until they are on it.

We do not sell outside the US, and this policy is written to US law. If you are reading it from somewhere else you are welcome, but the rights described below are the ones US state statutes grant.

Only what an order or a reply needs. There is no account to create on this site and nothing to log in to, so there is no profile of you sitting here between visits.

• When you buy something. Your name, delivery address, email address, phone number if you give one, and what you ordered. Payment card details go to Shopify's payment processor and never reach us — we see the last four digits and whether it worked.
• When you ask about a made-to-order run. Whatever you put in the mail — typically your organisation, your name, roughly how many you want and what it is for. There is no form to fill in: the build page is an email address, so this is only ever what you chose to write.
• When you write to us. Whatever is in the message, for as long as it takes to sort out what you wrote about.
• When you send us a photograph for the Rebels page. The image, and the written permission we asked you for first.
• Automatically, from your browser. The pages you visited, roughly where in the world you are, and what browser you used. This is ordinary web-server logging and it is not tied to your name.

We do not collect biometric data, precise geolocation, government identifiers, health data, or anything else US state laws class as sensitive personal information. We have no use for any of it, and the way to be sure it is never leaked is not to hold it.

To send you a scraper, to answer you, to honour a warranty claim, and to keep the tax and accounting records we are required by law to keep. That is the list.

We do not build profiles, we do not score you, and nothing on this site makes an automated decision about you.

The fewest parties that can get a parcel to your door. Each of them gets what that job needs and no more, and each is under a contract that stops them using it for anything else.

• Shopify, who run our checkout and hold the order. Card details go to their payment processors; we never receive them.
• The carrier who delivers the parcel, who gets your name, address and phone number.
• Our accountants and, where the law requires it, tax authorities.
• A court or a regulator, if we are legally obliged to hand something over. If we are allowed to tell you, we will.

That is the whole list of categories. There is no advertising network on it and no data broker, and if that ever changes this page changes first — see section 12.

This site loads no third-party scripts and sets no advertising cookies. Even the typeface is hosted by us rather than linked from Google Fonts, so opening a page here does not hand your IP address to a company you have never bought anything from.

We have never sold personal information, we do not share it for cross-context behavioural advertising, and we have no plans to start. We have not done either in the 12 months before the date at the bottom of this page. We do not sell or share the personal information of anyone we know to be under 16.

US state privacy laws define “sale” and “share” more broadly than an exchange of money, and that breadth is the point — handing data to an ad platform for targeting counts even when no invoice changes hands. So rather than rest on a definition, we give you the switch regardless.

The switch is on your privacy choices page, and it takes effect the moment you move it. If your browser sends a Global Privacy Control signal we treat that as the same request, on every page, without you having to find that one.

Around twenty US states have a comprehensive consumer privacy law, and the number grows most years. Working out which applies to you would mean establishing where you live before we would answer, so we do not: everyone in the United States gets the same rights.

• Ask what we hold about you, and get a copy.
• Ask us to correct it.
• Ask us to delete it, except where we must keep something to finish an order, honour a warranty or satisfy a record we are legally required to hold.
• Opt out of sale and of targeted advertising.
• Be treated no differently for asking — the same price, the same product, the same delivery.

Write to privacy@skiscraper.example and a person will answer. We aim to reply within 45 days, which is the deadline most of these laws set, and we will tell you if we need longer. If we turn a request down we will say why, and you can appeal by replying — most of these statutes give you that right and we extend it to everyone.

You may use an authorised agent. We will ask for proof you gave them permission and we may check with you directly, because the alternative is handing your order history to whoever asks first.

We may need to confirm you are who you say you are before we act, which normally means replying from the address the order was placed with. We will not use anything you send us to prove your identity for anything else.

California law requires every site to say what it does about browser privacy signals, so here it is, both of them, plainly.

Global Privacy Control we honour. If your browser or an extension sends it, we treat it as an instruction not to sell or share your personal information, for every visitor rather than only those in the states that now require it. You do not have to do anything else.

Do Not Track we do not act on, and nor does anybody else. The header was never finished as a standard, browsers send it inconsistently, and there is no agreed meaning to honour. Since we do not track you across other sites in the first place, there is nothing for it to switch off. Global Privacy Control replaced it, and that one we obey.

You will not see a cookie banner here. That is a decision rather than an oversight, and it is worth explaining because the internet has trained everyone to expect one.

A consent banner implements a European rule: nothing may be stored or read on your device until you agree. No US state has that rule. What US law gives you instead is the right to tell a business to stop — which is a switch, not a gate, and putting a gate in front of you that the law does not require would be asking permission we then have to be trusted to honour. We would rather give you the switch and load nothing that needed asking about.

So this site stores three things in your browser, all of them first-party, none of them advertising:

• The record of your privacy choice, so we do not lose it when you close the tab. Removing it is the one thing that would undo your own opt-out.
• What Shopify needs to carry your basket into checkout and to remember that choice on the checkout domain.
• Ordinary browser storage a page needs to work — remembering, for instance, which colourway you were looking at.

Clearing your browser's storage for this site clears all three, including the opt-out. If you do that, throw the switch again.

This shop is not for children. What we sell is a tool rather than a toy, and the terms of sale set out how to use it safely at length.

We do not knowingly collect personal information from anyone under 13, and we do not sell or share the personal information of anyone we know to be under 16. If you believe a child has sent us something, write to us and we will delete it.

Please do not send us photographs of yourself for the Rebels page if you are under 16.

California Civil Code §1798.83 lets California residents ask a business once a year for a list of the personal information it disclosed to third parties for those parties' own direct marketing.

We do not disclose personal information for that purpose, so the list would be empty. Ask anyway if you want it in writing: privacy@skiscraper.example.

Order records for as long as tax and accounting law requires, which is years rather than months and is not our choice. Warranty claims for the length of the warranty and a reasonable period after. Support messages until the thing they were about is finished and long enough after that we can recognise it if it comes back.

Anything we no longer have a reason to hold, we delete.

The date at the bottom is the effective date, and it changes whenever this page does.

If a change actually affects you — a new category of data, a new party it goes to, anything that would make a sentence above untrue — we will say so at the top of this page before it takes effect. A silent edit to a privacy policy is how a promise gets broken without anyone noticing, and we are not doing that.

You can also just check: this site is built from a git repository, so every version of this page has a date and an author.

Write to privacy@skiscraper.example. A person will answer, and we drop the theatrics when somebody has a problem.

A postal address belongs here and is outstanding.