Privacy policy

1. Who is responsible

Your personal data is handled by the administrator of the thirsttrap.com service. You can reach the administrator about anything in this policy at [email protected].

2. Adults only

ThirstTrap is a service for adults 18 and older. We do not knowingly collect data from anyone under 18. If we learn that an account or order belongs to a minor, we close it and delete the data.

3. What we collect

• Orders. Name, email address, shipping address, phone number if you give it, the products you order and the order history.
• Account. Email address, password stored as a secure hash, saved sizes and addresses.
• Payments. Checkout is paid in cryptocurrency only. We receive the payment status, the amount, the currency and the transaction reference from the crypto payment processor. We never see or store wallet private keys, seed phrases or any card data.
• The Drop. Membership status, size profile, skipped months and renewal dates.
• Creator applications. Contact details, alias, social profile links, a short bio and up to five photos, and later the age and identity verification result and payout details.
• Messages. What you write to support.
• Technical data. IP address, browser type and server logs needed to keep the site secure.

4. Why we use it

• To take, pay for, ship and support your order or membership.
• To send order, shipping and account emails.
• To review creator applications, verify age and identity, and pay commission.
• To prevent fraud and keep the site secure.
• To meet tax, accounting and other legal obligations.

We send marketing emails only if you opted in, and every such email has an unsubscribe link.

5. Who receives your data

We share data only with service providers who need it to run the shop, under contracts that limit their use of it.

• Our hosting provider, which stores the site and its database.
• A crypto payment processor that handles checkout payments.
• Our email delivery provider, which sends order and account emails.
• Shipping carriers, which receive your name and address to deliver the parcel.
• An identity verification provider, only for creators.
• Authorities, where the law requires it.

We do not sell personal data and we do not share it for cross context behavioral advertising.

6. Cookies

We use essential cookies only: the session, a security token, your bag, and the age confirmation stored in your browser. There are no analytics or advertising cookies and no tracking pixels, so no cookie banner is needed. Details are in our cookie policy.

7. How long we keep it

• Order and payment records, for as long as tax and accounting law requires.
• Account data, until you delete the account.
• Creator application data and photos, until the application is rejected or you ask us to delete them. Verification records of accepted creators, for as long as the law requires.
• Support messages, up to 24 months.
• Server logs, up to 90 days.

8. Your privacy rights

Depending on the state you live in, including California, Virginia, Colorado, Connecticut, Utah, Texas and other states with consumer privacy laws, you may have the right to:

• know what personal data we hold about you and get a copy;
• correct inaccurate data;
• delete your data;
• opt out of the sale of data, targeted advertising and profiling (we do none of these);
• appeal a decision we make about your request.

To use any of these rights, email [email protected] from the address linked to your account or order. We may ask you to confirm your identity. We answer within the time the law allows and we never treat you differently for using your rights.

9. Security

The site runs over an encrypted connection, passwords are hashed and access to order data is limited to the people who need it to serve you.

10. Changes

If we change this policy, we update the date at the top. Important changes are announced by email to account holders.