Privacy Policy

Last updated: July 6, 2026

SquishyMood Studio ("we", "us") operates https://squishymood.faithlink.xyz. This policy explains what we collect, why, and your rights.

What we collect

• Account data — email address and password (or Google sign-in) when you create an account.
• Order data — name, shipping address, phone, email, and the items you purchase.
• Newsletter — your email address, if you subscribe.

We do not sell or rent your personal information to anyone.

How we use it

• To process and deliver your orders and send order updates.
• To respond to support requests.
• To send the newsletter you signed up for (unsubscribe anytime, one click).

Where it lives

Account and order data is stored with Supabase (hosted in the US). Payments are processed by our payment providers (e.g. Stripe); we never see or store your full card number.

Stripe (payment processor)

When you pay by credit or debit card, your payment is processed by Stripe, Inc. (a US-based payment processor, PCI-DSS Level 1 certified). The following data is sent to and processed by Stripe solely to complete your payment and prevent fraud:

• Card number, expiry date, CVC, cardholder name (transmitted directly to Stripe — never stored on SquishyMood servers)
• Billing name and address
• Email address (for receipt delivery and fraud screening)
• IP address, device fingerprint, and browser metadata (for fraud/risk scoring)
• Order amount and currency
• Transaction status and Stripe-assigned charge identifiers

Stripe may store, process, and transfer this data in the United States and other countries where Stripe or its subprocessors operate. Stripe's use of your data is governed by the Stripe Privacy Policy, not this one. We do not have access to your full card number at any point.

Supabase (database & authentication)

Account credentials, order history, and shipping addresses are stored in our Supabase database (hosted in the US, AWS infrastructure). Supabase processes this data on our behalf as a data processor under a Data Processing Addendum.

Google OAuth (optional sign-in)

If you sign in with Google, Google shares only your email address and basic profile info (name, profile photo URL) with us. We do not receive your Google password or any other Google account data.

How long we keep it

• Account data — while your account is active; deleted within 30 days of account closure.
• Order data — 7 years for tax / accounting compliance, then deleted (or anonymized).
• Payment data — Stripe retains transaction records per its own policies; we retain only the last 4 digits of your card and the Stripe charge ID for refunds and accounting.
• Newsletter data — until you unsubscribe.

Your rights

You can request a copy of your data, correct it, or ask us to delete your account and associated data at any time — email hello@squishymood.faithlink.xyz. If you are in the EU/UK (GDPR) or California (CCPA), these rights are yours by law; we honor them for everyone.

Cookies

We use only functional storage (your cart, your login session). We don't run third-party advertising trackers.

Children

Our store is intended for purchasers aged 16+. We do not knowingly collect data from children.

Contact

Privacy questions: hello@squishymood.faithlink.xyz