Privacy policy

We're a five-product family business, not an advertising company. We collect the least we can get away with, and we don't sell any of it.

Who we are

Theory of Beauty LLC, an Ohio limited liability company based in Galloway, Ohio. This policy covers shoptheoryofbeauty.com. You can reach us any time at [email protected].

What we collect

When you place an order

Checkout is handled by Square, our payment processor. When you check out, you leave our site and complete payment on Square's. They collect your name, email, shipping address, and payment details.

Your card number never touches our website or our servers. We never see it, and we couldn't store it if we wanted to. What we see afterward is the order itself: what you bought, where to ship it, and how to reach you about it. Square's handling of your data is governed by Square's privacy policy.

When you use the contact form

We collect your name, email address, and your message — so we can reply. That's the entire purpose, and we don't use it for anything else.

When you leave a review

We collect the name you choose to display, your email address, your rating, and your review text. Your email is never published — we use it only to follow up if something's wrong. The name you enter appears publicly next to your review, so use a first name or initials if you'd rather.

Automatically, just by visiting

Our host, Cloudflare, keeps standard server logs: IP address, browser type, which pages loaded, and when. This is ordinary infrastructure logging — it's how any website stays online and fends off attacks. We don't build profiles from it, and we don't have a dashboard tracking you around the site.

Cookies

This site sets no cookies of its own, and we run no analytics or advertising trackers. That's why you won't see a cookie banner — there's nothing to consent to.

Your shopping cart lives in your browser's memory only, and it clears the moment you close the tab. Cloudflare may set a security cookie to tell real visitors from bots; that's a technical necessity, not tracking.

Who else touches your data

Only the services we genuinely need to run the shop:

• Square — payments, orders, and shipping fulfillment.
• Cloudflare — hosting, security, and the anti-spam check on our forms (Turnstile). Turnstile is privacy-preserving by design and doesn't track you across sites.
• FormSubmit — relays contact-form and review submissions to our email inbox.
• Google Fonts — serves the two typefaces the site uses. Loading them reveals your IP address to Google, as it would on most of the web. If you'd rather avoid that, a content blocker will stop it and the site still works.
• USPS — receives your shipping address so your order can arrive.

Each of these sees only the slice it needs. None of them are permitted to use your information for their own marketing, and we have never sold or shared your data for advertising.

How long we keep things

Order records are retained as long as Ohio and federal tax law require — generally seven years. Contact-form messages and review correspondence stay in our email until they're no longer useful, and we clear them out periodically. Published reviews stay up until you ask us to remove yours.

How we protect it

The whole site is served over HTTPS. Payment data is isolated at Square, which is PCI-compliant. Our own systems hold very little: essentially an email inbox and Square's order records, both protected by strong, unique passwords and two-factor authentication.

We'll be straight with you: no small business can promise perfect security, and anyone who does is overselling. What we can promise is that we collect little enough that a breach of our systems would expose very little.

Your choices

Whatever state or country you're in, you can ask us to:

• See what we hold about you.
• Correct anything wrong.
• Delete it, except records we're legally required to keep for taxes.
• Take down a review you left.

Email [email protected] and we'll take care of it within 30 days. No form, no account, no proving you're "really" a customer beyond confirming you control the email address. We won't charge you, and we won't treat you differently for asking.

Marketing email

We only email you about an order you placed, or because you wrote to us first. Buying something does not sign you up for anything. If we ever start a newsletter, it will be opt-in, and every message will have a working unsubscribe link.

Children

This site isn't directed at children under 13, and we don't knowingly collect their information. Our products are made for families and plenty of parents buy them for their kids — but the ordering is done by the grown-up. If you believe a child has given us information, email us and we'll delete it.

Changes to this policy

If we change it, we'll update the date at the top. If a change materially affects what we collect or who sees it, we'll say so plainly on this page rather than quietly editing a clause.

Questions

Email [email protected]. A person reads it — usually within one business day.