This policy covers the whole DAMA PIG site: browsing and searching kendamas, and buying from our first-party merch shop. It explains what data we collect, who we share it with, and why.
Analytics
We use Google Analytics 4 and a first-party analytics pipeline of our own to understand how the site is used. Both collect usage events (pages viewed, searches, clicks), never your name or contact details. Our own pipeline keeps a random ID in your browser so repeat visits from one device count as one person rather than several. That makes the data pseudonymous rather than anonymous: it is not tied to your name, but it is stable across visits. Each event is also stored with your IP address and browser user agent, which we use to tell devices apart and to filter out our own traffic.
Merch checkout
- Payment is handled entirely by Stripe. We never see or store your card number; Stripe processes the charge and hands us back a confirmation.
- Your name, shipping address, and email are shared with our print fulfillment partner solely so they can produce and ship your order.
- We keep a record of your order for accounting and customer support.
Emails
Restock and drop alerts are opt-in, and every alert email includes an unsubscribe link. Transactional emails, like order confirmations and shipping updates, go out any time you place an order, since we need those to fulfill it.
Text messages (SMS)
Text alerts are a separate, optional opt-in: you get them only if you tick the text-message box on an alert signup form and give us a mobile number. We store that number together with the time, wording, and IP address of your consent, and we use it for one thing: sending the kendama drop and restock alerts you asked for from DAMA PIG. Reply STOP to any message to opt out, or HELP for help. Message frequency varies and message and data rates may apply.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent are never sold, rented, or shared with anyone. We share your number only with the messaging provider that delivers the texts, and only to deliver them.
We don't sell your data
We don't sell your personal data to anyone. We share only what's needed to run the site and fulfill orders, as described above.
Cookies & local storage
We use cookies and your browser's local storage to remember your cart, favorites, site preferences, and a random analytics ID that tells us a returning device is the same one. These stay on your device and are never shared with other sites or used to follow you around the web. Clearing your browser storage resets the analytics ID. If you sign in to your Used account, your browser also keeps a sign-in token in local storage for up to 30 days. Choosing Sign out removes it.
Used listings
For used listings, we collect: your email, so we can send you your listing and order links; your government ID and date of birth if you verify your ID, collected and checked by Stripe; Dama Pig stores whether the check passed, the Stripe session id and a one-way hash of the document data, never the document or the date of birth; your ships-from ZIP, shown publicly only as "Ships from <state>"; your photos, public on the listing, sent to Amazon Rekognition to screen for prohibited content and to Anthropic's API to check that they show a kendama, then stored with their location and camera data (EXIF) removed; and the time, IP address and terms version of your "I agree to the terms" checkbox, and the time of your "I am 18 or over" checkbox, kept with the listing.
For an order, we collect both the buyer's and seller's shipping addresses. We share those with EasyPost and USPS to make the shipping label, and remove them from our records 90 days after the order ends, or 180 days if a buyer reported a problem.
When a buyer reports a problem, we collect their note, up to 3 photos and a phone number. The seller may reply with a note and photos. Each side sees the other's note and photos. We share the phone number with EasyPost and USPS to make the return label, and never show it to the seller. We delete the photos and the phone number 180 days after the order ends.
To prevent fraud and unpaid debt, we keep one-way hashes of ID document data, bank account and card identifiers. A hash cannot be turned back into the original. We keep them for 2 years after your last order.
We never collect your payment identity. Your name, bank account, and later your date of birth and the last four of your SSN, are collected by Stripe, not by Dama Pig.
Unconfirmed listings and their photos are deleted after 24 hours. Photos of listings we remove are deleted after 90 days. A sold listing stays public with its price and photos until you delete it from your Listing link. Separately, we may keep a copy of any photo you upload, including ones we hold back or remove, with location and camera data stripped, in a private store that is never public, to check listing quality and to test and improve our automated photo checks. We keep those copies for up to 2 years. Email us to have yours deleted sooner. We keep a record of emails we've blocked for safety reasons indefinitely.
Signing in
You do not need an account to buy. If you sell, or want one page for your orders, you can sign in to your Used account with a link we email you. We keep an account record keyed by your email: when it was created, the time and method of your last sign-in, and counters we use to sign you out everywhere.
Passkeys are optional. If you add one, we store its public key, its credential ID, a random account handle, the authenticator model ID (AAGUID) if your device shares it, and the times it was added and last used. We never receive your biometrics, and the private key never leaves your device or password manager.
Your browser keeps a sign-in token in local storage for up to 30 days. Sign out removes it from that browser. Sign out everywhere ends every session and every emailed link.
Sign-in links work once, for 10 minutes. Listing, order and offer links sent after this change last 1 year. Records that mark a sign-in link as used delete themselves automatically within a few days.
Our sign-in analytics use a one-way hash of your email, never the address or your IP address.
Changing your email is not supported yet. Start fresh on the new address, and email support@damapig.com to close the old one. To delete your account, email the same address. We keep what open orders, disputes, legal holds, payment and tax records need, and the 2-year fraud hashes described under Used listings.
Children
Dama Pig is not directed to children under 13 and does not knowingly collect their information. Sellers must be 18 or over: you confirm it when you list, and Stripe may check your ID before a first payout. If you believe a child under 13 gave us information, email support@damapig.com and we will delete it.
About this policy
We do not respond to browser Do Not Track signals.
When we change this policy, we update the date at the top and describe any material change in a note under it.
The effective date of this policy is the "Last updated" date at the top of this page.
Your data, your choice
To see, update, or delete the data we hold about you, email support@damapig.com. For merch-shop questions, see our Terms and Returns & Refunds pages.
Questions
Reach us any time at support@damapig.com, or .