Privacy Policy

The short version

We are a yarn shop. We collect the information needed to take your order, ship it, answer your questions, and keep the site working. We don't sell your personal information. We do measure how the shop is used — which pages and products get looked at, and where orders come from — with Google Analytics and with our own error and performance logging. That measurement uses a cookie holding a random identifier for your browser, and it is never given your name or your email address.

We also pay to advertise the shop, on Google and on Microsoft Bing. Since September 2026 the site carries Microsoft's advertising tag, which tells Microsoft that a visit followed one of our ads and whether it ended in an order. It is set by Microsoft rather than by us, it uses its own cookies, and Microsoft can use it to show you our ads on other sites. That is a real change from what this page said before, and it is why the paragraph you are reading exists. It runs only for visitors in the United States, which is where we ship — outside the US it is never loaded at all. If you are in the US and would rather it did not run, decline in the cookie notice or send a Global Privacy Control signal, and it stops.

The rest of this page is the detail.

Who we are

Yarn Country, LLC of Sandpoint, Idaho, USA is the controller of the personal information described here. To reach us about privacy, use the contact form.

What we collect

Information you give us

• Order details — name, shipping and billing address, email address, and phone number where you provide one.
• Account details — your email address and, if you create an account, an authentication record held by our sign-in provider. We never see or store your password.
• Messages — whatever you write in the contact form, plus the name and email you send it with, so we can reply.
• Reviews, questions and answers — the words, the star rating, the display name you choose, and the email address you post them with. The display name and the words are public; the address never is. See Reviews, questions and answers below.

Information collected automatically

• Server logs — IP address, browser user-agent, the pages requested, and timestamps. Our hosting and API providers record these to serve the site and detect abuse.
• Usage and error reports — as a page loads, your browser sends our diagnostics services the page's address and title, how long the page took to load and draw, how the shop's own data requests performed, and any error it ran into, with the technical detail needed to fix it. These reports also carry the identification your browser sends to every site it visits — its user-agent, which names the browser and operating system version — and a random identifier that ties together the reports from a single browser tab, so we can follow one visit's sequence of events while diagnosing it. That identifier is not a cookie, is discarded when you close the tab, never spans two visits, and is not linked to your account. Nothing in these reports names you. When the site shows you an error with a reference code, that code is what points us at the matching report. As any server does, each service records the IP address a report arrives from — for one of the two that is our own server's address rather than yours, because those reports pass through it.
• Analytics — we use Google Analytics 4 to understand how the shop is used: pages and products viewed, searches run, items added to the cart, and orders placed, along with the general things any analytics tool records — approximate location from your IP address, device and browser type, and the site or campaign that referred you. It reaches Google through Cloudflare Zaraz, which runs the tool from Cloudflare's network instead of loading Google's script in your browser. We do not send your name, email address, or postal address to Google, and we have not turned on the Google Analytics features that link this data to advertising audiences.
• Local storage in your browser — your cart contents and a cart identifier are kept in your own browser's local storage so the cart survives a reload. This data stays on your device; it is sent to us only when it becomes an order. The random per-tab identifier described above is kept in session storage, which your browser empties when the tab closes.
• Advertising measurement — we advertise the shop on Microsoft Bing, and the site carries Microsoft's Universal Event Tracking tag so Microsoft can tell us whether an ad we paid for led to a visit and an order. It records the pages you view here, the products you look at, and the value of an order you place, along with a click identifier Microsoft adds to the link when you arrive from one of our ads. Like our analytics it reaches Microsoft through Cloudflare Zaraz, but unlike our analytics it is an advertising product: Microsoft may also use it to build audiences and show you our ads on other sites. We do not send Microsoft your name, email address, or postal address, and the tag is loaded only for visitors in the United States.
• Cookies — four kinds. An affiliate cookie, only if you arrived through an affiliate link, recording that link's code for 30 days so the shop or blog that sent you gets credited for an order. An analytics cookie, holding a random identifier that lets Google Analytics tell one visit from the next; it holds no name, address or email. The cookies our payment and sign-in providers set when you check out or sign in, which is what keeps those steps working. And Microsoft's advertising cookies, set by bat.bing.com rather than by this site, which record that you visited and hold the click identifier from an ad for up to three months. The first three do not follow you to another site. The fourth is an advertising cookie and can.

What we don't collect

We never send our analytics, our advertising measurement, or our error reports the contents of what you type, your payment details, or your name and address. Our Google Analytics remains measurement only: it is not linked to Google's advertising products, not used to build audiences, and not used to show you ads anywhere. We don't collect special-category data, and the site is not directed at children under 13.

Gift cards

When you buy a gift card we ask for the recipient's email address, and optionally their name and a message from you. We use them for one thing: delivering that card, by email, once we have reviewed the order. The recipient's address is kept with the card so we can resend the delivery email if it goes astray and so you can see, on your account page, who each card was sent to. We do not add recipients to any mailing list, and nothing about the recipient is sent to Stripe or PayPal. The card's code is stored only as a one-way hash; we can tell whether a typed code is right, but we cannot read the code back, and we never show it anywhere but the delivery email.

Payment information

Card details are entered into and handled by our payment processor. Full card numbers never reach our servers and we do not store them. We keep only what we need to identify a transaction — the last four digits, the card brand, and the processor's reference — so that we can match refunds to orders.

Why we use it

Purpose	Basis
Taking, packing, and shipping your order	Performance of our contract with you
Answering your messages	Performance of a contract, or our legitimate interest in customer service
Keeping your account secure	Legitimate interest in security and fraud prevention
Counting page views, measuring performance, and diagnosing errors	Legitimate interest in keeping the site working and improving it
Measuring how the shop is used, with Google Analytics	Legitimate interest in understanding and improving the shop — consent where local law requires it
Measuring whether our ads work, with Microsoft's advertising tag	Consent where local law requires it; otherwise our legitimate interest in knowing which advertising is worth paying for
Keeping tax and sales records	Legal obligation
Sending order emails	Performance of our contract with you
Sending marketing email	Your consent, which you can withdraw at any time

Order confirmations, shipping notices, and dye-lot questions are transactional — they're part of fulfilling your order, and they aren't marketing. You can unsubscribe from marketing email at any time using the link in any such message without affecting the transactional ones.

Who we share it with

We share personal information only with the service providers who make the shop work, and only with what they need:

• Payment processing — to take payment and handle refunds.
• Shipping carriers — name, address, and contact details, so your parcel can be delivered.
• Hosting and infrastructure — the platforms that run this site, our order API, and our search index.
• Authentication — the provider that verifies your sign-in.
• Email delivery — to send order and reply emails.
• Diagnostics — the two services that hold our page-view counts, performance measurements and error reports. They are monitoring tools we run for ourselves, not advertising or audience-profiling products.
• Analytics — Google, as the provider of Google Analytics, and Cloudflare, whose Zaraz service delivers the measurement to it. They receive the usage data described above, not your order details.
• Advertising — Microsoft, as the provider of Microsoft Advertising and its Universal Event Tracking tag, again delivered through Cloudflare Zaraz. Microsoft receives the pages and products you viewed here, the value of an order, and the click identifier from one of our ads — not your name, email address, or postal address.
• Store rating badge — the cart and checkout pages load a small widget from Google that displays our current Google Merchant Center store rating. Loading it tells Google the page was viewed, the same as any script served from Google; it carries none of your cart or order details.
• Review surveys — after a completed order, the confirmation page offers Google's "rate your purchase" prompt. To make that offer, we give Google your email address, order number, and estimated delivery date. Google emails you a short survey only if you accept the prompt; decline it and no survey is sent. Your answers feed the store's public seller rating.

We may also disclose information where we are legally required to, or to establish or defend legal claims. If the business is ever sold or merged, customer records may transfer as part of it; we'd tell you first.

We do not sell your personal information, and we never have.

California law also treats disclosing information to an advertising network so it can show you ads elsewhere as "sharing". Microsoft's advertising tag, described above, may amount to that. You can opt out of it at any time: send a Global Privacy Control signal from your browser, or decline in the cookie notice. Either withdraws consent for the tag and it stops running.

Where it's held

Our providers are based in the United States, and information is processed there. If you're visiting from outside the US, your information is transferred to the US under safeguards appropriate to that transfer.

How long we keep it

• Order and tax records — as long as tax and accounting law requires, typically seven years.
• Account records — until you ask us to close the account, plus any period needed to complete open orders.
• Contact form messages — up to two years, so we have context if you write again.
• Server logs — a short rolling window kept by our providers for security and diagnostics.
• Usage and error reports — a rolling window set on each of our diagnostics services; old reports age out and are not kept for the long term.
• Analytics data — the retention window set on our Google Analytics property, which is at most 14 months for the visitor-level data. Aggregate reports built from it may be kept longer; they describe traffic, not people.

Reviews, questions and answers

When you post a review, a question or an answer, the text, your star rating, the colorway or size it was about, and the display name you chose are published on the product's page and may appear in search results and in our structured data for that product. We keep your email address with it so we can confirm it is yours, tell you when it is published or answered, and let you remove it; the address is never shown. Posts are read by an automated check for spam and abuse and, when that check raises a concern, by a person at the shop. A "helpful" vote is stored against a random key your browser keeps, not against you.

We email a review request once after an order ships, with one reminder. Every one carries an unsubscribe link, and the same switch is in your account settings. A published review can be removed with the link in its confirmation email, or by writing to us.

Marketing email

We send marketing email only to addresses that asked for it: the sign-up form in the footer and on guides, the box at checkout, or your account settings. Anyone who signs up without being signed in gets a confirmation link first, and nothing is sent until it's used. After an order we may send one thank-you code with two reminders and one request to review what you bought; you can stop those too.

Every marketing email carries an unsubscribe link and a link to your preferences, which show what the address gets from us and let you change it topic by topic or stop everything. If you don't have an email to hand, ask for your preferences link at /email/preferences — it needs no sign-in.

We keep a record of each sign-up, confirmation and unsubscribe (the date, the source, and the IP address it came from) as proof of consent, and a log of each marketing email sent so that bounces stop further mail. Addresses that unsubscribe are kept, unsubscribed, so they are never added again by mistake. Order and shipping emails are about your purchase and are always sent.

Your choices and rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct anything inaccurate;
• Delete it, subject to records we must legally keep;
• Port it to another provider;
• Object to or restrict certain processing;
• Withdraw consent to marketing at any time;
• Not be discriminated against for exercising any of these.

To exercise any of them, write to us from the email address on the account. We'll verify who you are before acting and respond within the time your local law allows — 30 days in most cases, 45 under California law.

If you're in the EEA or UK, you also have the right to complain to your data protection authority.

Security

The site is served over HTTPS. Access to order data is limited to staff who need it. Passwords are held by our authentication provider and are never visible to us.

No system is perfectly secure, but if a breach ever affects your personal information we'll notify you and the relevant regulator as the law requires.

Do Not Track

Microsoft's advertising tag does follow you beyond this site — that is what an advertising tag is for, and we would rather say so plainly than leave you to find out from a cookie list. Nothing else here does.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as an opt-out of both: the shop stops sending the shopping events described above — what you viewed, searched for, added to the cart, or ordered — and withdraws consent for every tool Cloudflare Zaraz runs on our behalf, Microsoft's advertising tag included. A plain count of the page having been loaded may still be recorded, because that one is counted by our network provider before the page reaches you. To switch off that as well, any content blocker will do it; nothing on this site depends on analytics, and the shop works exactly the same without it.

Separate from analytics, we keep anonymous operational records so we can fix what breaks: how long pages took to load, which pages were involved, and any errors, together with the browser identification your browser sends to every site it visits (its user-agent, which names the browser and operating system version — the same detail our server logs already record). These records are not linked to your name, email or account, use no cookie, and use no identifier that outlives your browser tab. Because they identify no one and exist to keep the site working, they are not affected by these signals.

Changes to this policy

We'll update this page when our practices change, and revise the "last updated" date above. Material changes will be announced on the site.

Contact

Yarn Country, LLC — Sandpoint, Idaho, USA. Write to us with any privacy question and a human will answer.