Privacy and data

Your name, email, phone, shipping and billing address, and order history. Payment card numbers go straight to our processor — we never see or store them. We also collect basic device and usage data: pages viewed, referring site, and a rough location from your IP.

To take payment, ship your order, answer support messages, prevent fraud, and improve the site. With your consent, to send marketing email and texts. Analytics tell us which pages work — including the live "people looking at this right now" count on product pages, which is aggregate and never tied to you by name.

Only the services that run the business: Shopify for the store and checkout, our payment processor, ShipStation and the carriers for delivery, our email and text platform, Trybe for the creator program, and analytics providers. Each gets only what it needs, and none may use it for their own marketing. We also disclose data when the law requires it.

We don't sell personal information for money. Advertising cookies can count as "sharing" for targeted ads under some state laws — you can turn that off with the cookie control at the bottom of any page, or by using Global Privacy Control in your browser, which we honor automatically.

Essential cookies keep your cart and login working and can't be switched off. Analytics and advertising cookies are optional and off until you accept them. Meta, Google, and TikTok pixels only load once you've opted in.

Marketing messages need your opt-in. Unsubscribe from any email, or reply STOP to any text alert you signed up for. Order and shipping notifications aren't marketing, so those keep coming until the order is done.

Reviews, contest entries, and creator content are public by nature, along with the name or handle you attach. Don't include anything in a submission you wouldn't want seen.

Order records stay seven years for tax and accounting. Support messages stay three years. Marketing contacts stay until you unsubscribe, and analytics data is kept 14 months.

Wherever you live, you can ask us for a copy of your data, correct it, delete it, or opt out of targeted advertising — and we won't treat you differently for asking. Email crew@flyaflag.com or use the request in your account. We verify it's you, then answer within 45 days.

The site runs on HTTPS, admin access needs two-factor, and payment data is handled by PCI-compliant processors. No system is perfect; if a breach ever affects you, we'll notify you as the law requires.

The site isn't for anyone under 13 and we don't knowingly collect their information. If a child's data reached us, email us and we'll delete it.

Data Deletion