Privacy policy

Privacy Policy — last updated October 14, 2026

Den & Nook uses information to prepare orders, provide support and keep this store working. This policy explains the information involved, the services that receive it and the choices you have. Nya Labs LLC is responsible for this storefront, which operates at denandnook.com.

Information involved in shopping with us

We do not sell customer lists. Optional advertising measurement is described below. The email you provide at checkout is for transactional contact; it does not subscribe you to marketing. We do not currently operate an email-marketing signup or mailing list.

Services and people who receive information

• Whop, Inc. — payment processing, receipts and refunds, under Whop's privacy policy.
• Our fulfillment partners in Asia and the United States — receive your name, shipping address, phone number and the items ordered so they can pack and ship your parcel. This means your delivery details are transferred outside the United States for that purpose.
• Shipping carriers — name, address and phone for delivery.
• Resend — sends transactional order, delivery and secure-access emails. See Resend’s privacy policy.
• Zoho Mail — hosts our customer-support inbox and the messages you send us. See Zoho’s privacy policy.
• Website hosting providers — operate the storefront and its order records on our behalf.
• Google — browser advertising measurement under the regional settings below, and separate server purchase reporting only after your affirmative acceptance. See Google’s privacy policy.
• Professional advisers, and authorities where the law requires.

If you separately consent to publishing a review or photo, we may publish it only for the uses you agreed to. We do not publish private support messages or return, damage or other claim photos without separate permission. We otherwise share information only as described above.

Your basket, quiz and essential storage

Necessary cookies and browser storage support your basket, checkout, secure order access and security. Browser-session storage also remembers that you have seen the welcome quiz and any quiz discount you earned. Your quiz answers are not sent as analytics or saved with an order. A checkout cookie lasts up to seven days. Administrator sign-in also uses platform-managed security storage.

Cloudflare provides hosting security and may set the __cf_bm cookie to distinguish automated traffic from visitors. It expires after 30 minutes of inactivity. This security cookie is separate from optional store measurement. See Cloudflare’s cookie information.

Optional store analytics

Store analytics starts off and requires your acceptance of this updated purpose. We keep aggregate product-interest counts and use a random, short-lived session reference to measure product-detail views, bag actions and checkout steps. We can link that session to your server-confirmed order to understand where shopping visits lead to purchases. The session reference stays in this tab; our server keeps only its hash. It expires after 30 minutes of inactivity or 24 hours. We record product IDs, quantities, device-size category, a safe landing-page path, referring website hostname when available and limited campaign labels (UTM source, medium and campaign). We do not record your name, email, address, payment details, IP address, raw URL/query string or raw browser user-agent in these analytics. We do not use fingerprinting.

Raw session, event and order-link records become eligible for deletion after 30 days and are removed in bounded batches as new analytics events arrive. Aggregate daily product counts can remain for store reporting. Withdrawing analytics permission clears this tab’s session reference and requests deletion of its session events and order link. A necessary session-storage marker retries this privacy request when the connection returns. This does not delete order records needed to provide and account for your purchase. If browser storage is unavailable or cleared before a failed request succeeds, contact us for help. Global Privacy Control and Do Not Track keep optional analytics off. Earlier grants for aggregate-only counts are not reused for this expanded purpose; earlier rejections stay in effect. We process analytics on our hosting infrastructure and do not send it to Google or another analytics service. Google Analytics is not enabled.

Optional advertising measurement

Google Ads browser measurement is on by default when our server identifies your visit as being in the United States, unless you have a saved advertising opt-out or your browser sends Global Privacy Control or Do Not Track. Outside the United States, or when we cannot determine your location, the tag stays off until you accept the advertising choice. You can turn it off from the privacy notice or Cookie & privacy choices, also linked in our footer. Shopping and checkout work either way.

This US default is not saved as your consent. Optional store analytics and our separate purchase reporting from the server still require your affirmative acceptance. The browser tag helps us understand which ads lead to purchases. Google receives ad-click identifiers, browser and network information (including IP address), page information, and, for a confirmed retail purchase, its merchandise value after discounts, currency, a random order reference, purchased product IDs, quantities, unit prices and the order discount. Purchase value excludes sales tax and delivery charges. We do not send your name, email, address or payment details through this feature. Enhanced conversions, personalized advertising and Google Analytics are not enabled. This measurement uses advertising cookies; it is separate from our store analytics. See Google's privacy policy and how Google uses information from sites.

Google's `_gcl_` advertising cookies normally last 90 days, subject to browser restrictions. We save your separate advertising choice in `den-nook-advertising` for up to 180 days and keep attempted-conversion references in browser session storage to reduce duplicate events. Google applies its own data-retention rules; cookie lifetime does not describe how long Google retains all measurement data. See Google's cookie information and retention information. Turning advertising measurement off removes this site's first-party Google advertising cookies and refreshes the page when needed to stop its loaded tag. It cannot undo information already sent. Global Privacy Control and Do Not Track prevent this measurement, even after an earlier acceptance.

Use the privacy notice to accept or reject optional measurement, or manage store counts and Google Ads separately in Cookie & privacy choices. You can turn Google Ads browser measurement off there at any time, including when it was enabled by the US default. We save choices you make, their version and time in this browser for up to 180 days. If those choices are cleared or expire, store counts and server purchase reporting require acceptance again; the regional default may apply to the browser tag when no saved opt-out remains. Default-on settings are not consent. Global Privacy Control and Do Not Track override both the US default and an accepted choice. Your basket, checkout and order updates work either way.

Whop has its own cookies and data practices when you open its secure checkout, described in Whop's privacy policy. Our optional-measurement control does not disable Whop's payment service. See our Cookie policy for the storage inventory. You can control or clear storage in your browser settings; blocking necessary storage may prevent your basket or checkout from working.

Optional charity preferences

If you choose to save a charity preference, we store the selected charity, a random browser identifier and the time of your selection. A preference cookie remembers that choice for up to one year and lets you update it. We set it only when you save your preference; accepting store measurement does not cast a vote. This preference is not linked to your email, payment or order. It helps inform our first planned donation; it is not a binding election. No purchase is required. We keep preference records while planning our first donation. Cookie expiry or clearing removes this browser’s access to its saved preference; it does not automatically delete the stored record.

Secure order access

When you request access from another device, we use your order reference and checkout email to send a private, single-use link. The link expires after 15 minutes. Opening it and confirming access sets an essential, order-specific cookie for up to seven days. We also keep hashed security identifiers and access timestamps to limit repeated requests and protect order information. This service does not subscribe you to marketing.

Retention

Order and payment records, including the order contact email: 7 years, for tax and accounting. Support communications and photos: 3 years. Browser-session storage and the checkout cookie have the durations described above. Measurement choices are valid for up to 180 days. An expired acceptance no longer enables store counts or server purchase reporting. The Google Ads browser tag follows the regional settings above when no saved opt-out remains; an old local record may remain until replaced or cleared. We retain aggregate daily product counts for store reporting. Temporary duplicate-event references become eligible for removal after one day and are removed in bounded batches as new measurement events arrive.

Protecting your information

The site uses HTTPS. Card data is handled by Whop's systems and never touches our servers. Access to order data is limited to the people who need it. No system is perfectly secure, so we do not promise that it is, and we hold no third-party security certification.

Privacy requests and your rights

You can ask to access, correct or delete the personal information we hold about you. Email team@denandnook.com or call (641) 500-6076 and provide the email address you ordered with; we respond within 30 days. We may need reasonable identity verification before disclosing or changing a record. We may retain records required for accounting, legal obligations or unresolved transactions, and will explain any limitation. We do not penalize you for exercising a privacy right. Do not send passwords, full card details or a security code with a request.

Depending on where you live and which laws apply, you may have additional rights concerning your personal information. Email team@denandnook.com or call (641) 500-6076 to exercise those rights. Nothing in this policy limits rights provided by applicable law.

Children

Our site is for adults. We do not knowingly collect information from anyone under 16.

Updates to this policy

We identify revisions with a new effective date here. When a change requires additional notice or consent, we provide that before applying the new practice.

Contact for privacy questions

Nya Labs LLC · (641) 500-6076. Neither is a returns address; contact us for return instructions.

Optional purchase reporting after checkout

Only after you affirmatively accept the current Google Ads measurement choice, we save an ad-click identifier (`gclid`, `wbraid` or `gbraid`) and that permission with your order. The US browser default alone does not enable this server purchase reporting. This lets our server report a verified purchase to the same Google Ads conversion action even if you close the checkout page. We send the original payment time, merchandise value after discounts, currency, ad-click identifier and random order reference. This feature does not send your name, email, address or payment details and does not enable personalized advertising. We use the same order reference to avoid counting the same purchase twice.

The optional browser record `den-nook-order-attribution` retains the click identifier and choice for up to 90 days from capture. Raw identifiers on our server are deleted after that period, or after seven days for an unpaid checkout. Non-identifying delivery references and outcomes may remain for reconciliation. An earlier acceptance does not enable this expanded purpose until you make the updated choice.

Withdrawing advertising consent clears the browser record and requests deletion of saved click identifiers and suppression of pending reports for orders linked to this browser’s checkout cookie. The necessary `den-nook-ads-withdrawal-pending:*` markers retry privacy requests if the network is unavailable; each is removed when its request succeeds. Withdrawal cannot recall an in-flight report or undo data already sent to Google. If your checkout cookie has expired, or you used a different device, contact team@denandnook.com for help with a privacy request. Global Privacy Control and Do Not Track also stop this optional capture and request withdrawal for this browser.

Business correspondence

Nya Labs LLC
1001 S Main St, Ste 600
Kalispell, MT 59901-1498
United States

This is our registered business office, not a warehouse or return address. Please contact team@denandnook.com for return instructions before sending an item.