Legal

Privacy Notice

Last updated: October 29, 2026

wristraw ("wristraw," "we," "us," or "our") makes a metal straw that folds into a bracelet. This notice explains what personal information we collect through wristraw.com (the "Site"), how we use and share it, and the choices and rights you have — including specific rights for California residents. It applies to visitors, customers, and account holders worldwide, since the Site is available internationally even though our operations are based in California.

This is a privacy notice — it covers personal data, not product safety or materials certifications. Because wristraw is a drinking straw that comes into contact with your mouth and beverages, any claims about food-contact-safe materials, cleaning instructions, or product safety live in our product listings and packaging, not here. If you're looking for that information, please check the product page or contact us directly.

1. Information We Collect

Information you give us

• Account information: name, email address, and password (stored as a secure hash, never in plain text) when you create an account or sign in.
• Order information: shipping address, billing details, phone number, and payment information you enter at checkout. A phone number is required to place an order, and we use it to contact you about your order. Card numbers are collected and processed directly by our payment processor, Stripe — wristraw never sees or stores your full card number.
• Communications: anything you send us, such as customer support emails or messages.
• Chat messages: what you type into the Ask wristraw assistant and the replies it gives you (see Section 2A). Please don't enter payment details or other sensitive information in the chat.
• Newsletter signup: your email address, if you subscribe to marketing updates.

Information we collect automatically

• Device and usage data: IP address, browser type, pages viewed, and referring pages, collected through standard web server logs.
• Our own browsing record: if analytics is allowed for your visit, a small script from wristraw.com records how you move through the Site. It records the pages you view, the links and buttons you click (the destination or the button label, with any digits replaced by "#", and never anything you type into a form), how far you scroll, how many seconds you are active on each page and on each section of a page, the site or campaign that sent you (referring site and UTM tags, and whether an ad click ID was present, but never its value), your device type, browser family and screen width rounded to the nearest 10 pixels, your country (from our network provider), and a copy of the events we already send to Google Analytics, such as viewing a product, adding to cart or starting checkout, limited to a short list of fields. It never records your IP address, name, email address, phone number or payment details.
• Server log analysis: our web server keeps standard logs. Once a day we analyze them to count visits and see which pages visitors view. This analysis does not depend on your cookie choice. It does not keep your IP address, does not use any identifier, and does not link your visits across days. For visitors in countries where consent is required before analytics (such as the EU and UK), we keep only daily totals.
• Advertising identifiers: unless you opt out of ad tracking, the Meta Pixel cookies (_fbp, and _fbc if you arrive from a Meta ad), the TikTok Pixel cookie (_ttp, plus a click ID if you arrive from a TikTok ad) and, when you place an order, your IP address and browser user agent, which we send to Meta together with the purchase event.
• Shopping cart data: the contents of your cart and your selected colors/sizes, stored in your browser (via local storage) so your cart persists as you browse.

Information from third parties

• Social sign-in: if you choose "Continue with Google" or "Continue with Facebook," those services share your name, email address, and profile ID with us so we can create or match your wristraw account. We never receive your Google or Facebook password.
• Verification services: Cloudflare Turnstile evaluates your browser session to confirm you're not a bot before you can log in or create an account.

2. How We Use Your Information

We use the information above to:

• Create and manage your account, and let you sign in with Google or Facebook if you choose to.
• Process orders, payments, and shipping, and show you your order history.
• Respond to customer support requests.
• Send you the newsletter and marketing emails you've opted into (and let you unsubscribe at any time).
• Detect and prevent fraud, abuse, and bot activity (via Cloudflare Turnstile).
• Maintain and improve the Site.
• Understand how visitors move through the Site, for example where they enter, which pages and sections they spend time on, and where they leave, so we can improve the Site.
• Comply with legal obligations, such as tax and accounting requirements.

We do not sell your personal information for money. We do use analytics and advertising technologies — such as Google Analytics, the Meta (Facebook) Pixel, the TikTok Pixel, Microsoft Clarity, and Umami — to understand how the Site is used and to measure and improve our own marketing. Under California law, our use of advertising technologies like the Meta Pixel and the TikTok Pixel may be considered sharing your personal information for cross-context behavioral advertising. You can opt out at any time — see Section 5 (California Privacy Rights) and Section 6 (Your Privacy Choices), or use the "Do Not Sell or Share My Personal Information" link in our footer.

When you complete a purchase and have not opted out, we also send the purchase event to Meta from our servers (the Meta Conversions API). That event includes the order value and currency, your IP address and browser user agent, the Meta cookie identifiers, and versions of your email address, name, phone number, city, state, ZIP code and an identifier derived from your account or email address, each converted with a one-way hash. We never send your payment details, street address, password or date of birth. If you opt out (through the "Do Not Sell or Share My Personal Information" link, the cookie choices, or a Global Privacy Control signal), we send none of this.

2A. The Ask wristraw Assistant (AI Chat)

The chat on the Site, called Ask wristraw, is an AI assistant. Its replies are generated by Claude, an AI model from Anthropic. A person on our team does not write them.

What we collect. Your message and the assistant's reply; the page you were on (the path only, such as /shop.html); the time; whether you typed the message or tapped a suggested question; and a random conversation ID created when the page loads. That ID is not linked to your account or your email address. If you tap thumbs up or thumbs down, we also record the rating and the first 200 characters of that reply. Before a chat is stored, our system replaces email addresses and phone numbers with a placeholder. It does not catch everything, such as a name or a street address, so please keep personal details out of the chat.

Who handles it. To write a reply, we send your message to Anthropic, together with up to the last 12 messages of that conversation. Anthropic handles that data under its own terms and privacy policy. Our workflow provider, n8n, stores the chat log. We use stored chats to find wrong answers and improve the assistant. We use your IP address to limit how fast one visitor can send messages. We do not store it in the chat log.

Your choices. "Clear conversation" in the chat menu removes the conversation from your browser. Because chat logs are not tied to your name or email, we usually cannot find one person's chat. They are deleted automatically on the schedule in Section 9. Questions about a chat? Contact us using the details in Section 11.

3. Cookies & Similar Technologies

The Site uses functional cookies and browser-storage technologies to operate, plus analytics and advertising technologies to understand how the Site is used and to measure our own marketing:

• Session cookie: keeps you signed in to your account (set by our server, expires when you log out or your session ends).
• Cloudflare Turnstile: sets a short-lived cookie/token while verifying you're human on the login and sign-up forms.
• Local storage: your shopping cart is stored in your browser's local storage, not a cookie, so it stays with you across pages until you check out or clear your browser data.
• Google Analytics 4 (analytics): sets cookies such as _ga to measure Site traffic and how visitors use the Site, so we can improve it.
• Meta (Facebook) Pixel (advertising): sets cookies such as _fbp to measure the performance of our own ads and website actions. This is an advertising technology — you can opt out at any time (see below).
• TikTok Pixel (advertising): loads from TikTok's servers and sets cookies such as _ttp to measure the performance of our own ads and website actions. Like the Meta Pixel, it follows your cookie choices: it does not load if you choose "Do Not Sell or Share My Personal Information" or "Reject all cookies", or if your browser sends a Global Privacy Control signal, and in the EU and UK it loads only after you accept.
• Chat history: your current conversation with the Ask wristraw assistant is kept in your browser's session storage so it survives a page reload. It is dropped after 24 hours or when you choose "Clear conversation".
• Microsoft Clarity (analytics): helps us see how visitors use the Site (for example, aggregated click and scroll behavior) so we can improve it.
• Umami (analytics): privacy-focused, aggregated Site analytics.
• Browsing record identifiers: the browsing record above uses two random identifiers. A visitor ID (stored in your browser's local storage as "wr_vid") lets us recognize a returning browser for up to 13 months. A session ID (stored in session storage as "wr_rs") groups the pages of one visit and renews after 30 minutes of inactivity. Neither contains your name or email. Choosing "Reject all cookies" deletes both and stops the record, including mid-visit. Where a banner asks first (such as the EU and UK), the record starts only after you accept. Elsewhere it starts by default. Opting out of sale or sharing, including through a Global Privacy Control signal, turns off the advertising pixels but does not turn off this first-party record. "Reject all cookies" does.
• Abuse protection: to limit automated traffic, our server keeps a short code derived from your IP address with a secret key. We keep it for up to 30 days and never store it with your browsing record.

Where required (for example, for visitors in the EU/UK), these analytics and advertising technologies load only after you consent through our cookie banner. Elsewhere, you can opt out at any time using "Cookie Settings" or the "Do Not Sell or Share My Personal Information" link in the footer, and we automatically honor the Global Privacy Control (GPC) browser signal. You can also block or delete cookies through your browser settings; doing so may prevent you from staying logged in or completing checkout.

4. How We Share Your Information

We share personal information only with the service providers who help us run the Site, and only for the purposes described above:

• Stripe — payment processing.
• Google — Site analytics (Google Analytics 4), and account sign-in only if you choose "Continue with Google."
• Meta (Facebook) — advertising measurement through the Meta Pixel and the Meta Conversions API (sign-up and purchase events sent from our servers), used to measure and improve our own ads, and account sign-in only if you choose "Continue with Facebook." Under California law this may be considered "sharing" for cross-context behavioral advertising; you can opt out (see Section 5 and the footer link).
• TikTok: advertising measurement through the TikTok Pixel and the TikTok Events API (sign-up events sent from our servers; not sent if you opted out, see Section 5), used to measure and improve our own ads. Under California law this may be considered "sharing" for cross-context behavioral advertising; you can opt out (see Section 5 and the footer link).
• Anthropic: the AI model behind the Ask wristraw assistant (see Section 2A).
• n8n (our workflow provider): stores the Ask wristraw chat log (see Section 2A).
• Microsoft — website behavior analytics (Microsoft Clarity).
• Amazon Web Services and n8n — newsletter and email delivery, if you subscribe.
• Cloudflare — bot/human verification (Turnstile).
• Our hosting providers — to store and serve the Site and its database.

We do not sell your personal information for money, and these providers may only use the information to perform their services for us (except that advertising technologies like the Meta Pixel and the TikTok Pixel may involve "sharing" as defined by California law, which you can opt out of as described in Section 5).

We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of business assets — in which case this notice would continue to apply to your information under the new owner.

5. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you the following rights over the personal information we collect about you:

• Right to Know — what personal information we've collected, used, disclosed, or (if applicable) sold about you in the past 12 months, and why.
• Right to Delete — request that we delete personal information we've collected from you, subject to certain legal exceptions (e.g., completed order records we're required to keep for accounting purposes).
• Right to Correct — request that we correct inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing — we do not sell your personal information for money. However, our use of advertising technologies such as the Meta (Facebook) Pixel and the TikTok Pixel may be considered sharing of personal information for cross-context behavioral advertising under the CCPA/CPRA. You have the right to opt out, and we honor two methods: (1) the "Do Not Sell or Share My Personal Information" link in our footer, and (2) the Global Privacy Control (GPC) browser signal, which we detect and apply automatically.
• Right to Limit Use of Sensitive Personal Information — we only collect account login credentials as sensitive personal information (per the CCPA's definition), and we use them solely to operate your account — we don't use them for any other purpose that would trigger this right.
• Right to Non-Discrimination — we will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised any of these rights.

If you choose "Do Not Sell or Share My Personal Information" or "Reject all cookies", if your browser sends a Global Privacy Control signal, or if you are in the EU or UK and have not accepted cookies, we still save your sign-up, saved cart or order on our own systems, but our servers do not send it to Meta (Conversions API) or to TikTok (Events API). For everyone else, those sign-up and purchase events are sent as described in Section 4.

Categories of personal information we collect

Mapped to the categories defined in Cal. Civ. Code § 1798.140, in the past 12 months we have collected:

• Identifiers — name, email address, phone number, IP address, account username.
• Customer records — shipping/billing address, payment details (processed by Stripe).
• Commercial information — order and purchase history.
• Internet/network activity — pages viewed, browsing behavior on the Site, and what you type into the Ask wristraw assistant.
• Sensitive personal information — account login credentials (password, stored as a secure hash).

We collect this information directly from you, automatically as you use the Site, and from the third-party sign-in services described in Section 1. We use and disclose it only for the business purposes described in this notice.

How to submit a request

To exercise your Right to Know, Delete, or Correct, contact us using the details in the Contact Us section, telling us which right you'd like to exercise and the email address on your account. We'll need to verify your identity (typically by confirming details tied to your account) before fulfilling the request, and we'll respond within 45 days, as required by law (extendable once by an additional 45 days for complex requests). You may also designate an authorized agent to submit a request on your behalf; we may ask the agent for proof of your written authorization.

6. Your Privacy Choices

• Marketing emails: unsubscribe using the link at the bottom of any marketing email, or contact us.
• Cookies: control or delete cookies through your browser settings.
• Account data: contact us to request a copy of, correction to, or deletion of your account information.

7. International Visitors

wristraw is based in California, USA, and the Site is available to visitors worldwide. If you access the Site from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with its own data protection law, you may have rights similar to those described in Section 5 (for example, access, correction, deletion, and portability). Contact us using the details below and we will do our best to honor your request under the law that applies to you.

8. Children's Privacy

The Site is not directed to children, and we do not knowingly collect personal information from anyone under 13 (or under 16, where required by California law). If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Data Security & Retention

We use reasonable technical and organizational measures — such as password hashing and secure, provider-managed payment processing — to protect your personal information. No method of transmission or storage is 100% secure, and we can't guarantee absolute security. We retain personal information only as long as necessary to provide the Site, complete transactions, comply with legal and tax obligations, and resolve disputes, after which we delete or anonymize it. Chat logs from the Ask wristraw assistant are deleted once they are older than 90 days. The cleanup runs once a month, so a conversation can stay in our logs for up to about four months. Thumbs up and thumbs down ratings are deleted on the same schedule.

Browsing records tied to a visitor ID are deleted after 25 months. We treat the visitor ID as personal information even though it is a random number. We do not link browsing records to your account, orders or newsletter signup, and we report on them only in groups of at least 3 visitors. To ask us to delete the records tied to your browser, contact us using the details in Section 11 and include the value of "wr_vid" from your browser's local storage, because we cannot find your records without it.

10. Changes to This Notice

We may update this notice from time to time. If we make material changes, we'll update the "Last updated" date at the top of this page. We encourage you to review this notice periodically.

11. Contact Us

If you have questions about this notice or would like to exercise any of the rights described above, contact us at:

wristraw
support@wristraw.com
310 A Street, San Diego, CA 92101