We collect as little as we can. Here is all of it.

• When you join the email list: your email address, the page you joined from, and the time.
• When you order or preorder: your name, email address, phone number, shipping address, and the details of what you bought. Stripe, our payment processor, collects your card details; we never see your card number. The phone number goes to the carrier with the parcel.
• When you start a checkout: which pack you chose, the link or ad that brought you (including the click id Meta adds to its ad links), your browser type, and a scrambled form of your internet address that cannot be turned back into it. If you do not finish, Stripe tells us the checkout was opened and, only if Stripe's "Keep me updated" box was left checked (Stripe may check it for you; untick it if you do not want email from us), your email address, so we can send you one reminder with a link back to your basket.
• When you tick the box to receive texts: your mobile number, the time, the page, your internet address and the version of the wording you agreed to, as the record of your consent.
• When you write to us: whatever you put in the email.
• When you visit: our hosting provider keeps standard server logs (IP address, browser type, pages requested, time) for security and to keep the site running. We do not use these to profile you. We count page views ourselves, without cookies or third parties.

• No advertising company's code runs in your browser on this site, and we set no advertising or analytics cookies. When you press the buy button, our own server sends Meta (the company behind Facebook and Instagram) a record so we can tell which of our ads led to orders: the amount, the item, the time, your internet address, your browser type and, if you came from one of our ads, the click id Meta put in that link. After a purchase it sends the amount, the items, the time, your browser type, that click id, and your email, phone, first and last name, city, state, ZIP code, country and the customer number our payment processor gives you, each in scrambled form (a one-way hash that Meta can match to an account but cannot read back). You can stop this for yourself; see Your choices and rights below.
• We do not sell your personal information. Sending hashed order details to Meta to measure our own ads counts as sharing under California law, and you can opt out of it. We share nothing with anyone for their marketing.
• We do not knowingly collect information from anyone under 18. This site sells to adults.

The public site sets no cookies of its own, with one exception: if you use the Do not sell or share my information link, we set one cookie for twelve months so we remember your choice. Cloudflare, which protects the site from attacks and automated abuse, also sets its own short-lived security cookies (__cf_bm, which expires after 30 minutes without activity, and cf_clearance, which records that your browser passed its automatic check). They are strictly necessary to keep the site running safely and are never used for advertising or analytics. If you switch the page between dark and light, that choice is saved in your own browser's local storage, and if you close the price bar at the bottom of the page on a phone, that is remembered in your browser for the visit; neither is ever sent to us. Our staff sign-in page sets one session cookie for staff only. Because there are no advertising or analytics cookies, there is no banner.

When you pay, you are on Stripe's checkout page, which has its own cookies and its own privacy policy at stripe.com/privacy.

• To take your order, charge you, ship to you, and email you a receipt, shipping updates, and anything about that order.
• To email you about Baraké if you joined the list. Every such email has an unsubscribe link, and we stop when you use it.
• To send you one reminder if you start a checkout, leave Stripe's "Keep me updated" box checked, and do not finish. That email has an unsubscribe link.
• To email you news and offers about Baraké if you buy from us and leave Stripe's "Keep me updated" box checked. Every such email has an unsubscribe link, and we stop when you use it.
• To answer you when you write to us.
• To keep the site secure and to meet legal duties such as tax records.

A few companies process data on our behalf, under their own security and privacy commitments. Each receives only what it needs for its job. Meta, the last but one below, is different: sending it data counts as sharing, not as a service done for us.

• Stripe (payments, sales tax): your checkout details, card details, and order amount.
• SendGrid, by Twilio (email delivery): your email address and the content of order emails we send you.
• Railway (hosting): our database and server logs live on its servers in the United States.
• Cloudflare (security and delivery): every visit to barakesoap.com passes through Cloudflare, which sees your IP address and browser details to block attacks and automated abuse, sets short-lived security cookies to do so, and runs the quick check on our forms that tells a person from a script.
• The shipping carrier: your name, address and phone number, printed on the parcel or given for delivery.
• Google Fonts (typefaces): your browser fetches the site's fonts from Google, which sees your IP address and nothing else about you.
• Meta Platforms (ad measurement): when you start a checkout and after a purchase, the details listed under What we do not do above, sent from our server, so we can see which ads led to sales. Meta's privacy policy is at facebook.com/privacy/policy.
• OpenPhone (text messages): your phone number and the texts we send you.

• Order records: seven years, because tax law requires it.
• Email list: until you ask us to remove you. If you unsubscribe, we keep your address on a do-not-email list so we never write to it again.
• Server logs: a short rolling window, typically under 90 days.
• Checkouts that were started and not finished: 90 days, then the email address, the click id, the browser details and the reminder we sent are deleted and only the count remains.
• A log of the emails we sent you about an order: as long as the order it belongs to.
• Text consent records: five years after the last message we sent you.

If you tick the box to receive texts, we send you a message when your bars ship and, now and then, a Baraké update, up to four texts a month, from an automated system. Consent is not a condition of buying. Message and data rates may apply. Reply STOP at any time to stop, or HELP for help. We keep a record of when and where you agreed, because the law may ask us to show it. Our text messages are sent through OpenPhone, which receives your phone number and the message.

We never share the number you give us for texts, or your consent to receive them, with anyone for their marketing.

Write to staff@barakesoap.com and we will tell you what we hold about you, correct it, or delete it, except where the law makes us keep it (a paid order stays in our tax records). Unsubscribe from the list with the link in any email. We answer within 30 days. We do not sell personal information. Because we send hashed order details to Meta to measure our ads, California law counts that as sharing, and you can opt out at any time with the Do not sell or share my personal information link in the footer, or by writing to us. We also treat the Global Privacy Control signal from your browser as an opt-out. California residents have the rights above all the same, and we will not treat you differently for using them.

• The Do not sell or share my personal information page is at barakesoap.com/privacy/choices. It works with or without your email address.

The site is served over HTTPS only. Card details never touch our servers. Staff access is protected by a password and a second factor. No system is perfect; if we ever learn of a breach affecting your data, we will tell you.

If this policy changes in a way that matters, we will change the date at the top and, for anything significant, email the list. Questions go to staff@barakesoap.com, or by post to [Baraké legal entity name], [Street address, City, MI ZIP, United States].