Privacy

Last updated 8 November 2026.

Old Town Roasting runs this store. This page says what we collect when you order, subscribe, sign in or write to us, why, how long we keep it and who else sees it. Questions: email shawn@oldtownroasting.com or use our contact form.

What we collect and why

• When you order: your email, name and shipping address, what you bought (coffee, grind, quantity) and the totals. We use them to roast and ship your order, send your receipt and answer questions about it. We also note the internet address the order came from, to spot fraud.
• Card payments: you type your card on Authorize.net's secure form. We never see or store your card number. If you subscribe, Authorize.net keeps your card for the renewals and we keep only their reference to it, the card type, the last four digits and the expiry date.
• Subscriptions: your plan, coffee and grind, billing day, whether it's active, paused or cancelled, and the reason you give if you cancel (optional).
• Your account: there's no password. You sign in with a link we email you; we store only a scrambled copy of that link and of your sign-in session.
• Contact form: your name, email, topic and message, so we can reply. A copy is emailed to our inbox.
• Emails we send you: receipts, sign-in links and subscription notices, with a copy of each kept in our records, and marketing notes only if you joined the mailing list.
• Mailing list: your email and when you confirmed, used only for notes from the roaster, and you can unsubscribe any time.
• Assistant chats: what you type and the replies you get, kept for 90 days and then deleted.
• Server logs: like any website, our server logs each request (internet address, page, time) to keep the site running and secure.

Who else sees it

• Authorize.net processes card payments and holds saved cards. Their payment form, shown in a frame when you pay, is their page and follows their privacy policy.
• IONOS, our hosting provider, runs the server this site and its database are on.
• Google Workspace (Gmail) holds our mailbox, so messages you send us, including through the contact form, are forwarded there, while our order emails and sign-in links go out from our own mail server, which IONOS hosts.
• DeepSeek powers the website's assistant, has servers in China, and receives what you type there, plus signed-in customers' order and subscription status but not their address, email or card details, and our staff tools also use it to draft replies from the message being answered.
• The US Postal Service sees your name and address on the package.
• Cloudflare Turnstile: if checkout shows a "not a robot" check, Cloudflare sees your internet address and browser details to tell people from bots.

We don't sell your personal information or share it for advertising, and we don't use advertising or analytics trackers.

How long we keep it

Orders, subscriptions and customer records are kept while the store runs; nothing is deleted automatically. Contact messages are kept until we delete them. Assistant chats are deleted after 90 days. Sign-in links stop working after 30 minutes and sign-in sessions after 30 days. Ask us and we'll delete what we don't need to keep for tax and accounting.

Your choices and rights

Wherever you live, and under California law (CCPA) if you're a California resident, you can ask what we hold about you, for a copy, to correct it or to delete it, and we won't treat you differently for asking. We don't sell or share personal information, so there's nothing to opt out of. To ask, email shawn@oldtownroasting.com or use our contact form; we'll confirm it's you by writing to the email address on your orders.

Children

This store is for adults. It isn't directed at children under 13 (16 in the EU and UK), and accounts and subscriptions are for adults. If we learn we hold a child's information, we delete it.

Cookies

We only use cookies the store needs to work, set by us and signed so they can't be altered:

• your cart (kept for 30 days);
• a one-minute cookie that carries messages such as "Added to your cart";
• a list of the orders placed from this browser (7 days), so only you can open their payment and thank-you pages;
• your sign-in session, when you sign in (30 days, or until you sign out).

We don't use advertising or analytics cookies, so there's no cookie banner.

Changes

If this policy changes, we'll update it here and change the date at the top. See also orders, subscriptions and refunds.