Privacy Policy

The short version

We are a yarn shop, not an advertising business. We collect the information needed to take your order, ship it, answer your questions, and keep the site working. We don't sell your personal information and we run no advertising trackers. We do measure how the shop is used — which pages and products get looked at, and where orders come from — with Google Analytics and with our own error logging. That measurement uses a cookie holding a random identifier for your browser. It is never given your name or your email address, and we don't use it to advertise to you here or anywhere else.

The rest of this page is the detail.

Who we are

Yarn Country, LLC of Sandpoint, Idaho, USA is the controller of the personal information described here. To reach us about privacy, use the contact form.

What we collect

Information you give us

• Order details — name, shipping and billing address, email address, and phone number where you provide one.
• Account details — your email address and, if you create an account, an authentication record held by our sign-in provider. We never see or store your password.
• Messages — whatever you write in the contact form, plus the name and email you send it with, so we can reply.

Information collected automatically

• Server logs — IP address, browser user-agent, the pages requested, and timestamps. Our hosting and API providers record these to serve the site and detect abuse.
• Usage and error reports — as a page loads, your browser sends its address and title to our own diagnostics service, so we can see which pages get used and notice when something breaks. Errors are reported the same way, with the technical detail needed to fix them. No cookie is involved and nothing in the report names you or follows you between visits; the service records the IP address and browser the report arrives from, as any server does.
• Analytics — we use Google Analytics 4 to understand how the shop is used: pages and products viewed, searches run, items added to the cart, and orders placed, along with the general things any analytics tool records — approximate location from your IP address, device and browser type, and the site or campaign that referred you. It reaches Google through Cloudflare Zaraz, which runs the tool from Cloudflare's network instead of loading Google's script in your browser. We do not send your name, email address, or postal address to Google, and we have not turned on the Google Analytics features that link this data to advertising audiences.
• Local storage in your browser — your cart contents and a cart identifier are kept in your own browser's local storage so the cart survives a reload. This data stays on your device; it is sent to us only when it becomes an order.
• Cookies — three kinds, all set by this site rather than by an ad network. An affiliate cookie, only if you arrived through an affiliate link, recording that link's code for 30 days so the shop or blog that sent you gets credited for an order. An analytics cookie, holding a random identifier that lets Google Analytics tell one visit from the next; it holds no name, address or email. And the cookies our payment and sign-in providers set when you check out or sign in, which is what keeps those steps working. That is the whole list. No cookie here advertises to you or follows you to another site.

What we don't collect

We don't use advertising pixels, ad-network tags, or cross-site tracking cookies. Our analytics is measurement only: it is not linked to Google's advertising products, not used to build audiences, and not used to show you ads anywhere. We never send our analytics or our error reports the contents of what you type, your payment details, or your name and address. We don't collect special-category data, and the site is not directed at children under 13.

Payment information

Card details are entered into and handled by our payment processor. Full card numbers never reach our servers and we do not store them. We keep only what we need to identify a transaction — the last four digits, the card brand, and the processor's reference — so that we can match refunds to orders.

Why we use it

Purpose	Basis
Taking, packing, and shipping your order	Performance of our contract with you
Answering your messages	Performance of a contract, or our legitimate interest in customer service
Keeping your account secure	Legitimate interest in security and fraud prevention
Counting page views and diagnosing errors	Legitimate interest in keeping the site working and improving it
Measuring how the shop is used, with Google Analytics	Legitimate interest in understanding and improving the shop — consent where local law requires it
Keeping tax and sales records	Legal obligation
Sending order emails	Performance of our contract with you
Sending marketing email	Your consent, which you can withdraw at any time

Order confirmations, shipping notices, and dye-lot questions are transactional — they're part of fulfilling your order, and they aren't marketing. You can unsubscribe from marketing email at any time using the link in any such message without affecting the transactional ones.

Who we share it with

We share personal information only with the service providers who make the shop work, and only with what they need:

• Payment processing — to take payment and handle refunds.
• Shipping carriers — name, address, and contact details, so your parcel can be delivered.
• Hosting and infrastructure — the platforms that run this site, our order API, and our search index.
• Authentication — the provider that verifies your sign-in.
• Email delivery — to send order and reply emails.
• Diagnostics — the service that holds our page-view counts and error reports. It is a monitoring tool we run for ourselves, not an advertising or audience-profiling product.
• Analytics — Google, as the provider of Google Analytics, and Cloudflare, whose Zaraz service delivers the measurement to it. They receive the usage data described above, not your order details.

We may also disclose information where we are legally required to, or to establish or defend legal claims. If the business is ever sold or merged, customer records may transfer as part of it; we'd tell you first.

We do not sell or share your personal information for cross-context behavioral advertising, and we never have.

Where it's held

Our providers are based in the United States, and information is processed there. If you're visiting from outside the US, your information is transferred to the US under safeguards appropriate to that transfer.

How long we keep it

• Order and tax records — as long as tax and accounting law requires, typically seven years.
• Account records — until you ask us to close the account, plus any period needed to complete open orders.
• Contact form messages — up to two years, so we have context if you write again.
• Server logs — a short rolling window kept by our providers for security and diagnostics.
• Usage and error reports — a rolling window set on our diagnostics service; old reports age out and are not kept for the long term.
• Analytics data — the retention window set on our Google Analytics property, which is at most 14 months for the visitor-level data. Aggregate reports built from it may be kept longer; they describe traffic, not people.

Your choices and rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct anything inaccurate;
• Delete it, subject to records we must legally keep;
• Port it to another provider;
• Object to or restrict certain processing;
• Withdraw consent to marketing at any time;
• Not be discriminated against for exercising any of these.

To exercise any of them, write to us from the email address on the account. We'll verify who you are before acting and respond within the time your local law allows — 30 days in most cases, 45 under California law.

If you're in the EEA or UK, you also have the right to complain to your data protection authority.

Security

The site is served over HTTPS. Access to order data is limited to staff who need it. Passwords are held by our authentication provider and are never visible to us.

No system is perfectly secure, but if a breach ever affects your personal information we'll notify you and the relevant regulator as the law requires.

Do Not Track

We don't track you across other websites, and we don't sell or share your information for advertising — so there is nothing here for a Do Not Track signal to switch off in that sense. We do measure your visit to this site, as described above.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as an opt-out of that measurement: the shop stops sending the shopping events described above — what you viewed, searched for, added to the cart, or ordered. A plain count of the page having been loaded may still be recorded, because that one is counted by our network provider before the page reaches you. To switch off that as well, any content blocker will do it; nothing on this site depends on analytics, and the shop works exactly the same without it.

Changes to this policy

We'll update this page when our practices change, and revise the "last updated" date above. Material changes will be announced on the site.

Contact

Yarn Country, LLC — Sandpoint, Idaho, USA. Write to us with any privacy question and a human will answer.