Privacy policy

Last updated: October 24, 2026

This Privacy Policy explains how Sabre Johnson, operating as Stocking Stash ("Stocking Stash", "we", "us") collects, uses and protects your personal information when you visit our store or buy from us. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA), and we explain below the rights available to customers in the United States.

What we collect

Order details: your name, email, shipping and billing address, phone number (if you give it), what you bought and how much you paid.
Payment details: handled by Shopify Payments and the other payment providers shown at checkout. We never see or store your full card number.
Messages: anything you send us by email or our contact form.
Device and usage information: such as your IP address, browser, pages viewed and how you reached our site, collected through cookies and similar technologies.
Marketing preferences: whether you've agreed to receive our emails.

How we use it

To process, ship and track your order and send you order and shipping updates.
To answer your questions and handle replacements, refunds and cancellations.
To prevent fraud and keep the store secure.
To understand how the store is used and improve it.
To send you marketing emails, only if you've agreed (see "Marketing emails").
To meet our legal, tax and accounting obligations.

We collect only what we need for these purposes, and we ask for your consent where the law requires it. By placing an order you consent to us using your information to fulfil it.

Who we share it with

We don't sell your personal information. We share it only with service providers that help us run the store, and only as much as they need:

Shopify, our e-commerce platform, which hosts the store and processes orders. See Shopify's Privacy Policy.
Payment processors (Shopify Payments and others shown at checkout) to take payment and prevent fraud.
Our international suppliers and fulfilment partners, who receive your name, shipping address, phone number (if given) and order contents so they can pack and ship your order.
Shipping carriers and customs authorities, to deliver your parcel.
Analytics and app providers we use to run the store, such as Shopify's built-in analytics.
Authorities or others when the law requires it, or to protect our rights or prevent fraud.

Information stored outside Canada

Our service providers may store or process your information outside Canada, including in the United States, China and other countries where our suppliers and platforms operate. While there, it may be accessible to authorities under that country's laws. We choose providers who agree to protect your information.

Cookies and analytics

We and Shopify use cookies to make the store work (for example, to remember your cart and keep checkout secure), to remember your preferences, and to understand how visitors use the site. You can block or delete cookies in your browser settings, but some parts of the store, like the cart, may not work without them. Where required, you'll see a cookie banner to choose which optional cookies you allow. You can also visit our Your Privacy Choices page.

Marketing emails (CASL)

We send marketing emails only to people who have agreed to receive them, as required by Canada's Anti-Spam Legislation (CASL) and the US CAN-SPAM Act. Every marketing email identifies us, includes our mailing address and has an unsubscribe link; you can unsubscribe at any time and we'll process it within 10 business days. Order confirmations and shipping updates are not marketing, so you'll still receive those.

How long we keep it

We keep order records for as long as needed to fulfil your order and meet tax and accounting rules (in Canada, generally 6 years). We keep other information only as long as it's useful for the purposes above, then delete or anonymize it.

How we protect it

We use reasonable safeguards, including Shopify's secure, encrypted checkout and access controls on our accounts. No system is perfectly secure, and if a breach creates a real risk of significant harm, we'll notify you and the relevant privacy authority as the law requires.

Your rights

You can ask us to:

tell you what personal information we hold about you and give you a copy;
correct information that's wrong;
delete your information (unless we must keep it for legal reasons);
withdraw your consent, for example to marketing emails.

US residents: depending on your state (for example, California, Colorado, Connecticut, Virginia and others), you may also have the right to know what we collect and how we share it, to access, correct or delete it, and to opt out of the "sale" or "sharing" of personal information or targeted advertising. We don't sell personal information. If we use advertising cookies in future, you can opt out on our Your Privacy Choices page, and we honour Global Privacy Control browser signals where required. We won't treat you differently for using your rights.

To make a request, email rhett69123@gmail.com. We'll reply within 30 days and may need to confirm your identity first. An authorized agent can make a request for you with proof of your permission.

Children

Our store is meant for adults buying gifts. We don't knowingly collect personal information from children under 13 (or the age required by local law). If you think a child has given us information, contact us and we'll delete it.