Last updated October 9, 2026
Privacy policy
We’re two people pouring candles in Ohio. We collect only what we need to take your order and run your rewards account, we don’t track you around the internet, and we never sell your information.
This policy covers candlebrandcandles.com, run by Candle Brand Candles LLC, an Ohio limited liability company. Questions or requests: [email protected].
What we collect
When you create an account
- Name and email address — to sign you in, send your receipts, and confirm your email.
- Password — stored only as a one-way scrambled hash (bcrypt). We can’t see it, and nobody can turn the hash back into your password.
- Phone number (optional) — only if you add it, for questions about an order.
- Rewards points — what you’ve earned and redeemed.
When you place an order (with or without an account)
- Name, email and optional phone.
- Shipping address if we’re shipping to you, or the pickup spot you chose.
- What you ordered, the prices, sales tax, shipping cost, any promo code or points used, and any order note you write.
- Payment status and Stripe’s reference numbers for the payment. We never see or store your card number — you type it on Stripe’s secure checkout page, not ours.
- Shipping and tracking details once your order ships.
When you use the Contact form
Your name, email, message and (if you include it) order number are emailed to us so we can reply. They aren’t saved on the website.
Automatically
- Two cookies, both needed for the site to work (details below).
- Your IP address is checked for a few minutes to stop people from guessing passwords or spamming forms. It isn’t saved to our database or used to identify you.
What we don’t do
- No analytics, ad trackers, tracking pixels or session recording — nothing that watches how you use the site.
- No selling, renting or trading your information. No sharing for advertising.
- No marketing emails. We only email you about your account and your orders. If we ever start a newsletter, it will be opt-in only (you’d have to check a box), and every email will have a one-click unsubscribe.
Cookies
| Cookie | What it does | How long |
|---|---|---|
cbc_session | Keeps you signed in. Only set when you sign in. | 30 days, or until you sign out |
cbc_cart | Remembers what’s in your cart. | 30 days |
Both are first-party (only our site can read them) and can’t be read by scripts on the page. Because they’re strictly necessary and we don’t use any tracking cookies, there’s no cookie banner. Since we don’t track you, “Do Not Track” and Global Privacy Control signals have nothing to switch off — we treat everyone that way already.
Who we share it with
Only the services that make the shop work, and only what each one needs:
- Stripe — card payments and sales-tax calculation. Gets your name, email, phone (if given), address and order total. Stripe’s privacy policy.
- Shippo and the shipping carrier (USPS, UPS, etc.) — to buy a label and deliver your package. Gets your name and shipping address. Shippo’s privacy policy.
- Resend and Proton Mail — deliver our emails to you (receipts, password resets) and your Contact messages to us. Resend, Proton.
- Cloudflare — carries traffic to our site and blocks attacks; it sees your IP address and the pages you request. Cloudflare’s privacy policy.
We may also share information if the law requires it (for example, a valid court order), or with our tax preparer as part of the business’s records. The website itself runs on our own server, not a third-party host, and its fonts are served from our server too.
How long we keep it
- Your account — until you delete it.
- Orders — 7 years, because the business has to keep sales records for taxes. If you delete your account, your past orders stay in our records but are no longer connected to an account.
- Sign-in sessions — 30 days. Password-reset links expire after 1 hour; email-confirmation links after 2 days.
Your choices
- See and update your name, phone and password in Account settings; your orders and points are on your account page.
- Delete your account yourself at the bottom of Account settings.
- Ask for a copy of what we have about you, a correction, or deletion of your order details (beyond what tax law makes us keep) by emailing [email protected]. We’ll reply within 30 days and won’t treat you differently for asking.
Keeping it safe
The site only runs over encrypted HTTPS, passwords are hashed, card details never reach us, and only the two owners can open the admin side. No system is perfect — if your information were ever exposed, we’d tell you by email as quickly as we can and as the law requires, along with what happened and what to do.
Kids
Candles are open flames, and this shop is meant for adults. We don’t knowingly collect information from children under 13. If you believe a child has created an account or placed an order, email [email protected] and we’ll delete it.
Changes
If we change what we collect or how we use it, we’ll update this page and the date at the top. For a big change — like starting a newsletter — we’ll also tell account holders by email before it applies to them.