Privacy Policy

The short version

We are a yarn shop, not an advertising business. We collect the information needed to take your order, ship it, answer your questions, and keep the site working. We don't sell your personal information, and we run no advertising trackers and no third-party analytics. We do count page views and log errors ourselves, without cookies and without building any profile of you.

The rest of this page is the detail.

Who we are

Yarn Country, LLC of Sandpoint, Idaho, USA is the controller of the personal information described here. To reach us about privacy, use the contact form.

What we collect

Information you give us

• Order details — name, shipping and billing address, email address, and phone number where you provide one.
• Account details — your email address and, if you create an account, an authentication record held by our sign-in provider. We never see or store your password.
• Messages — whatever you write in the contact form, plus the name and email you send it with, so we can reply.

Information collected automatically

• Server logs — IP address, browser user-agent, the pages requested, and timestamps. Our hosting and API providers record these to serve the site and detect abuse.
• Usage and error reports — as a page loads, your browser sends its address and title to our own diagnostics service, so we can see which pages get used and notice when something breaks. Errors are reported the same way, with the technical detail needed to fix them. No cookie is involved and nothing in the report names you or follows you between visits; the service records the IP address and browser the report arrives from, as any server does.
• Local storage in your browser — your cart contents and a cart identifier are kept in your own browser's local storage so the cart survives a reload. This data stays on your device; it is sent to us only when it becomes an order.
• Cookies — one of ours, and only if you arrived through an affiliate link: it records that link's code for 30 days so the shop or blog that sent you gets credited for an order. Our payment and sign-in providers set their own cookies when you check out or sign in, which is what keeps those steps working. That is the whole list. No cookie here advertises to you or follows you to another site, and the page counts described above don't use one.

What we don't collect

We don't use advertising pixels, ad-network tags, or cross-site tracking cookies, and we don't hand what you do here to a third-party analytics product. The page counts described above stay with us. We don't collect special-category data, and the site is not directed at children under 13.

Payment information

Card details are entered into and handled by our payment processor. Full card numbers never reach our servers and we do not store them. We keep only what we need to identify a transaction — the last four digits, the card brand, and the processor's reference — so that we can match refunds to orders.

Why we use it

Purpose	Basis
Taking, packing, and shipping your order	Performance of our contract with you
Answering your messages	Performance of a contract, or our legitimate interest in customer service
Keeping your account secure	Legitimate interest in security and fraud prevention
Counting page views and diagnosing errors	Legitimate interest in keeping the site working and improving it
Keeping tax and sales records	Legal obligation
Sending order emails	Performance of our contract with you
Sending marketing email	Your consent, which you can withdraw at any time

Order confirmations, shipping notices, and dye-lot questions are transactional — they're part of fulfilling your order, and they aren't marketing. You can unsubscribe from marketing email at any time using the link in any such message without affecting the transactional ones.

Who we share it with

We share personal information only with the service providers who make the shop work, and only with what they need:

• Payment processing — to take payment and handle refunds.
• Shipping carriers — name, address, and contact details, so your parcel can be delivered.
• Hosting and infrastructure — the platforms that run this site, our order API, and our search index.
• Authentication — the provider that verifies your sign-in.
• Email delivery — to send order and reply emails.
• Diagnostics — the service that holds our page-view counts and error reports. It is a monitoring tool we run for ourselves, not an advertising or audience-profiling product.

We may also disclose information where we are legally required to, or to establish or defend legal claims. If the business is ever sold or merged, customer records may transfer as part of it; we'd tell you first.

We do not sell or share your personal information for cross-context behavioral advertising, and we never have.

Where it's held

Our providers are based in the United States, and information is processed there. If you're visiting from outside the US, your information is transferred to the US under safeguards appropriate to that transfer.

How long we keep it

• Order and tax records — as long as tax and accounting law requires, typically seven years.
• Account records — until you ask us to close the account, plus any period needed to complete open orders.
• Contact form messages — up to two years, so we have context if you write again.
• Server logs — a short rolling window kept by our providers for security and diagnostics.
• Usage and error reports — a rolling window set on our diagnostics service; old reports age out and are not kept for the long term.

Your choices and rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct anything inaccurate;
• Delete it, subject to records we must legally keep;
• Port it to another provider;
• Object to or restrict certain processing;
• Withdraw consent to marketing at any time;
• Not be discriminated against for exercising any of these.

To exercise any of them, write to us from the email address on the account. We'll verify who you are before acting and respond within the time your local law allows — 30 days in most cases, 45 under California law.

If you're in the EEA or UK, you also have the right to complain to your data protection authority.

Security

The site is served over HTTPS. Access to order data is limited to staff who need it. Passwords are held by our authentication provider and are never visible to us.

No system is perfectly secure, but if a breach ever affects your personal information we'll notify you and the relevant regulator as the law requires.

Do Not Track

We don't track you across other websites, so there is nothing for a Do Not Track signal to switch off. We honor Global Privacy Control signals as opt-out requests where applicable law requires it.

Changes to this policy

We'll update this page when our practices change, and revise the "last updated" date above. Material changes will be announced on the site.

Contact

Yarn Country, LLC — Sandpoint, Idaho, USA. Write to us with any privacy question and a human will answer.