Privacy
Lithorium is a one-person rock shop in San Jose, California. This page describes what the site collects when you visit or buy, who else receives it, and what the shop does not do with it.
The short version
- There are no accounts and no login. You cannot make one and the shop does not want you to.
- The shop never sees your card number. Payment happens on Stripe's own page.
- There is no advertising, no retargeting, and no third-party tracking pixel on this site.
- Nothing collected here is sold or shared for anyone else's marketing.
- The specimen tray on the front page is saved in your own browser and is never sent anywhere.
What is collected
When you buy something
Checkout is hosted by Stripe. You give Stripe your email address, your name and shipping address, and your payment details. The shop receives from Stripe the email address, the shipping address, which piece you bought, and the amount paid, so it can send you a rock. The shop does not receive your full card number and cannot see it.
When you write to the shop
The contact form records the name and email address you enter, the subject, the message itself, and the IP address the message was sent from. The IP address is recorded so that a flood of automated messages can be slowed down, and for nothing else.
When you just look around
The site is hosted on Cloudflare, which keeps ordinary request logs: the IP address, the time, the page requested, the browser's user agent string, and the referring page. This is the log every web server keeps, and it exists so a site can be operated and defended.
The shop runs no analytics product of its own at present. If that changes, this page changes with it.
Why it is collected
- To take payment, pack the right rock, and post it to the right address.
- To answer a message you sent.
- To handle a return, a refund, or a carrier claim.
- To keep the site working and to resist abuse of it.
- To meet the record-keeping the tax authorities require of a business that sells things.
None of it is used to build a profile of you, and none of it is used to advertise to you anywhere.
Who else sees it
| Who | What they receive | Why |
|---|---|---|
| Stripe | Email, name, shipping address, payment details | Processes the payment and issues the receipt |
| Cloudflare | IP address and request logs | Hosts and serves the site |
| Google Fonts | IP address, on every page load | Serves the two typefaces the site uses |
| USPS | Name and shipping address | Delivers the package |
Google Fonts is worth naming plainly, because it is the item small shops usually leave out.
The site loads its typefaces from fonts.googleapis.com and
fonts.gstatic.com, and that request tells Google your IP address whether or not
you buy anything. If you would rather it did not, a content blocker that blocks those two
hosts will stop it; the site remains readable in a system typeface.
Beyond those four, nothing. No data broker, no mailing list provider, no advertising network. Information may be disclosed if the law actually requires it, and the shop would rather tell you that plainly than pretend the situation cannot arise.
Cookies and browser storage
The site sets no advertising or analytics cookies. Two things are stored in your own browser:
- The specimen tray, under
lithorium-cart-v1in local storage. It is a list of which pieces you were looking at. It stays in that browser, is never transmitted, and clearing your site data removes it. - Progress in the browser tools on the apps page, saved the same way and for the same reason.
One cookie exists on this domain and it is not yours: a session cookie for the shop's own admin, set only when the owner signs in.
Stripe sets its own cookies on Stripe's page during checkout, under Stripe's policy.
How long it is kept
Order records are kept as long as the tax authorities require records of a sale, which in practice is several years. Messages sent through the contact form are kept until they have been dealt with and are then deleted. Cloudflare's request logs age out on Cloudflare's own schedule. Anything in your own browser lasts until you clear it.
Your rights
Wherever you live, you can ask the shop what it holds about you, ask for a copy, ask for it to be corrected, or ask for it to be deleted. Write through the contact page from the address you used at checkout, and you will get an answer within 30 days.
Order records that tax law requires to be kept cannot be deleted on request, and the shop will say so rather than quietly not doing it.
California residents
California law gives residents the right to know what personal information a business collects, to have it deleted, to have it corrected, and not to be treated differently for asking. Those requests go to the same place as any other, through the contact page.
Lithorium does not sell or share personal information as those terms are defined by California law, and never has.
Children
This site is not directed at children under 13 and the shop does not knowingly collect information from them. A rock is a fine thing for a child to own; the buying part is for an adult.
Security
The site is served over HTTPS only. Card details are handled by Stripe and never reach this site's servers. No system is perfect, and the shop will not claim otherwise.
Changes to this page
This page will be updated when what the site does changes. The date in the margin is the date of the last change, and it is a real date rather than a decoration.
Questions about any of this go through the contact page.