Last updated: October 2, 2026

This policy explains what information ANDRD Shop collects on andrd.shop and its subdomains (including tones.andrd.shop), why, who it goes to, and the choices you have. Orders placed on eBay (ebay.andrd.shop) or Etsy (andrd.etsy.com) are also covered by those marketplaces’ own privacy policies.

The short version

• We collect what we need to build, ship and support your order.
• Google Analytics, Microsoft Clarity and advertising tools wait for your consent. Separate basic site statistics count page loads and feature use without visitor IDs. Rejecting Analytics also stops these basic counts.
• We honor Global Privacy Control. If your browser sends that signal, advertising stays off.
• We do not sell your personal information for money.
• You can change your choice at any time with the Your privacy choices link at the bottom of every page.

1. Who we are

ANDRD Shop (andrd.shop) is a small business in Indianapolis, Indiana that restores, modifies and sells iPods and related parts. For anything privacy related, email [email protected].

2. Information we collect and why

When you place an order

• Contact and shipping details: name, email, phone, billing and shipping address, order notes. Used to make, ship and support your order, send order emails, and keep business and tax records.
• What you ordered: products, custom build configuration (colors, parts, options), price and order history.
• Payment: payments are processed by Stripe (cards, Apple Pay, Google Pay, Link, Cash App Pay, Klarna, Affirm, Afterpay and other methods shown at checkout). We never see or store your full card number. We receive the payment status, a transaction reference and the last four digits and brand of your card. Stripe uses its own cookies on the checkout page to prevent fraud. If you choose Klarna, Affirm or Afterpay, that provider handles your financing application under its own terms.

Accounts and sign in

• If you create an account, we store your name, email, password (hashed, if you set one), addresses, order history and any builds you save.
• You can sign in with Google or Discord. If you do, that service shares your name, email address and account ID with us so we can create or log in to your account. We never see your password for those accounts, and their sign-in code doesn’t load on our pages; you’re sent to their site only when you click the button.
• You can also sign in with a one-time email link. We email the link to the address you enter; it works once and expires after 20 minutes.
• Saved builds: if you save a build from the 3D builder, we store its options, a small picture of it and the price at the time with your account until you remove it.

Support, chat and reviews

• Support form: name, email, order number, your message and any photos you attach. New requests are forwarded to our internal task and notification tools so we can respond quickly.
• Chat: if a chat window or shopping assistant is available and you use it, your messages, any name or email you give, and basic technical information (browser, pages viewed) are processed and stored by the chat provider so we can answer. By starting a chat you agree to this. Please don’t share payment details in chat.
• Reviews: your name, rating, review text and any photos you upload are shown publicly on the product page.
• Email updates: if you sign up for launch alerts, restock notices or updates, we store your email until you unsubscribe.

Restock requests

When you request a restock, we record the item or model requested. Email is optional. If you choose an email notification, you must confirm the address before we send a restock notice. We use that address for the requested notice and do not add it to a mailing list.

A random browser token helps prevent duplicate requests. It lasts for your browser session unless you choose to remember requests for 30 days. A separate session token protects the request form. These cookies are named andrd_restock_session and andrd_restock_csrf and are set after you submit a request. We do not use device fingerprinting for this feature or share these requests with advertising services. A short-lived hash of the connection address helps limit repeated submissions; the feature does not store the raw address.

Request records are deleted after 180 days. Unconfirmed requests are removed after 30 days. You can stop notifications through the link provided in the restock email, or contact [email protected].

Collected automatically on every visit

• Security and delivery: our host and Cloudflare process standard request data (IP address, browser, pages requested, time) to deliver the site, block abuse and bots (including Cloudflare Turnstile checks on forms) and protect logins. Cloudflare may also record cookieless, aggregated performance statistics.
• Order attribution: WooCommerce stores first-party cookies noting how you arrived (for example a search, a social link or a campaign) so we can see which channels lead to orders. This stays with us.
• Shop functions: cart, checkout, login, recently viewed items, wishlist and your cookie choice. These are needed for the site to work.

Basic site statistics

We count page loads by broad page type, use of builder controls, review and help controls, add-to-cart button clicks, 3D model loading successes or errors, and grouped loading and active-page times. These totals help us find navigation and performance problems and improve the shop. They are not unique visitor counts or individual browsing histories.

This separate measurement runs on andrd.shop without tracking cookies, local storage identifiers or fingerprinting. Its statistics database stores daily counters only, with no IP addresses, visitor or account IDs, order details, option values, form text, full URLs, referrers or advertising click IDs. Counts are not linked across pages or combined with customer records, and are not sent to advertising or analytics companies. Our hosting and security services still process normal connection data to deliver and protect requests, as described above.

Basic counts can run before a cookie-banner decision. You can stop future counts with the Turn off basic site statistics button at the bottom of the page (inside the Privacy menu in the builder), or by rejecting Analytics in Your privacy choices. We also stop these counts when your browser sends Global Privacy Control or Do Not Track. The separate off preference uses a cookie named andrd_stats_off for up to 12 months; it contains no unique identifier. Basic statistics are retained for 90 days and reported as rounded totals. They are used for site operation and usability, not ad attribution, profiling or remarketing.

Only if you accept: Analytics

• Google Analytics 4: pages visited, how you got here, device and browser, approximate location, and shop events such as items added to cart.
• Microsoft Clarity: heatmaps and session replays of how pages are used (clicks, scrolling, mouse movement). Clarity masks text you type into form fields. We use this to find and fix problems with the site and the iPod builder.

Only if you accept: Advertising

• Meta Pixel (Facebook and Instagram), TikTok Pixel and Microsoft Advertising (UET): these tell each platform which pages and products you viewed, when you add to cart, start checkout or complete a purchase (order value, product IDs and an order reference), and when you use the iPod builder. They also use cookies and device identifiers. We use this to measure whether our ads work and to show ads to people who visited our site.
• Reddit Pixel and Conversions API: after advertising consent, we send page and product views, cart additions, and purchase events to Reddit. Purchases include order value, product IDs and an order reference. Browser and click identifiers, IP address and browser type help match events to ads. Confirmed purchases may be sent from our server using the advertising choice saved at checkout. Automatic email and phone collection is disabled.
• Google Ads: after you accept Advertising, Google receives ad click attribution information, including the page URL and device information, to measure ad visits. For a paid purchase, Google also receives the purchase value, currency and an order reference. We do not send email addresses or phone numbers automatically, use enhanced conversions, or personalize ads through remarketing.
• Under California and other state privacy laws, this can count as “sharing” personal information for cross-context behavioral advertising. You can opt out at any time (see section 5).

By clicking Accept (or turning a category on in Settings), you consent to the providers in that category receiving information about your use of our site as described above.

3. Cookies and similar technologies

Category	Examples	When it runs
Essential	WooCommerce cart and session cookies, login cookies, andrd_consent (your choice, 12 months), order attribution (sbjs_*), wishlist, recently viewed, security checks	Always. The site needs these to work.
Analytics	Google Analytics (_ga, _ga_*), Microsoft Clarity (_clck, _clsk)	Only after you accept Analytics
Advertising	Meta (_fbp, _fbc), TikTok (_ttp), Reddit (_rdt_uuid, andrd_rdt_cid), Microsoft Advertising (_uetsid, _uetvid, MUID), Google Ads (_gcl_*)	Only after you accept Advertising

4. Who we share information with

We share information only with companies that help us run the shop, and only what they need:

• Hosting, security and delivery: Hostinger (web hosting), Cloudflare (network, security, bot protection).
• Payments: Stripe, plus Klarna, Affirm or Afterpay if you pick one of them at checkout.
• Shipping: shipping carriers and label and tracking services receive your name, address and, where needed, phone and email.
• Email: our email delivery provider sends order and account emails.
• Support: our chat provider (when chat is offered) and our internal task and notification tools.
• Sign in: Google or Discord, only if you choose to sign in with them.
• Analytics and advertising (only with your consent): Google, Microsoft, Meta, TikTok and Reddit.
• Marketplaces: if you buy through eBay or Etsy, those platforms share your order details with us to fulfill it.
• Legal and safety: when required by law, to prevent fraud, or to protect our rights. If the business is ever sold or merged, customer records may transfer to the new owner under this policy.

We do not sell your personal information for money.

5. Your choices

• Cookie banner: choose Accept all, Reject, or pick categories in Settings.
• Change your mind: use Your privacy choices in the footer. If you turn something off, we clear its cookies and reload the page without it.
• Do Not Sell or Share / Global Privacy Control: turning off Advertising opts you out of the “sharing” described above. If your browser sends a Global Privacy Control signal, we treat it as that opt-out automatically.
• Platform settings: you can also manage ads through Meta ad preferences, your TikTok app’s Privacy settings, and Microsoft ad settings. Google offers an Analytics opt-out add-on.
• Emails: every marketing email has an unsubscribe link. Order emails are sent as needed to complete your purchase.

6. Your privacy rights

Wherever you live in the US, you can ask us to:

• tell you what personal information we have about you and give you a copy,
• correct information that is wrong,
• delete your information (we may keep what we are legally required to keep, such as order and tax records),
• stop using your information for targeted advertising or “sharing”.

Email [email protected] with your request. We will confirm it’s you (usually by matching the email on your order or account) and respond within 45 days. You can use an authorized agent if they have your written permission. If we decline a request, you can reply to appeal and we will review it again. We will never charge you more or treat you differently for using these rights.

7. How long we keep information

• Orders and invoices: as long as needed for accounting, tax and warranty purposes, generally up to 7 years.
• Accounts: until you ask us to delete the account.
• Support requests and chat transcripts: up to 2 years.
• Email list: until you unsubscribe.
• Analytics: Google Analytics data up to 14 months; Clarity session replays about 30 days.
• Advertising data: kept by each platform under its own policy.
• Your cookie choice: 12 months, then we ask again.

8. Security

The site runs over HTTPS, payments are handled by Stripe, and access to order data is limited to the people who fulfill orders. No system is perfectly secure, but we take reasonable steps to protect your information.

9. Children

This site is not directed to children under 13 and we do not knowingly collect information from them. If you believe a child has given us personal information, email us and we will delete it.

10. tones.andrd.shop

• No analytics or tracking. The tone composer runs entirely in your browser.
• Local storage: one entry (toneComposerHelpSeen) remembers whether you dismissed the help screen. Nothing is sent to a server.
• Community tone submissions: if you share a tone, the tone name, the author name you choose (can be “Anonymous”), description and tone data are stored and listed publicly. Don’t include personal information in these fields. There are no accounts, so email us to have a submission removed.

11. Changes to this policy

If we change how we handle your information, we will update this page and the date at the top. For significant changes we will also note it on the site.

12. Contact

ANDRD Shop, Indianapolis, Indiana
[email protected]