Privacy

Last updated: August 30, 2026.

1. What this is, and who it is from. This notice covers the personal information Mysterious Yard LLC collects through this website. It is written to describe what this store actually does, in the order somebody would want to ask about it.
California requires any commercial website that collects personal information from people in California to post a notice, and to answer five things in it. This is that notice, and the five are: what it collects (section 2), who else sees it (section 5), how you look at your information and get it corrected (section 10), how a change here is announced (section 14), and what this site does about a browser's Do Not Track signal (section 7).
This business is far below the size thresholds in the California Consumer Privacy Act. It is not a "business" as that law defines one, and it does not sell or share personal information at all. The rights in section 10 are offered anyway, as a matter of policy, to everyone who orders here rather than to Californians only. I honour them the same way whether or not a law makes me.

2. What is collected.

• Your order — the name, delivery address and email address on it, and a phone number if you give one; what you bought, what it cost, and the order history attached to your email address. If you type a delivery state or ZIP code into the cart, those too, so the shop can warn you about a destination it cannot post to, or a freeze at the other end, before it takes your money rather than after.
• Messages — the name, email address, subject and message you send through the contact page.
• Reviews — the display name you choose and the review itself, both published; the email address you may leave with it, which is used only to match the review against a paid order for the "Verified buyer" badge and is never published; and a photograph, if you send one and tick the boxes.
• The waiting list — the email address you give to be told when something is available, and anything you write with it.
• Damage claims and contributed corrections — what you write and any photographs you attach. Those photographs are evidence and are never published.
• Network detail, and the honest version of it — no IP address is ever stored against an order. A review, a contact message, a contributed correction, a content report, a waiting-list sign-up and a damage claim each store a one-way hash of the address they came from: a fingerprint that stops the same source flooding the form, and that cannot be turned back into an address. The counters that stop somebody hammering the sign-in page or the review form do hold a plain address, but only as the name of a counter, attached to nothing you sent, and every one of those rows is deleted inside a day. Ordinary web-server request logs exist wherever this site is hosted, the way they do for every site on the internet.
• Card numbers — never. They are typed on Stripe's own page and do not reach this site or me.
• Not collected at all — precise location, biometrics, and anything about your employment, education, health, race, religion, politics, union membership or sex life. Nothing here guesses anything about anybody or builds a profile of them.

3. Where it comes from. From you, and only from you: placing an order, writing through the contact page, posting a review, joining a waiting list, sending a correction. Nothing is bought from a data broker, nothing is scraped from anywhere, and nothing arrives here from an advertising network.

4. What it is used for. Taking and filling your order. Buying postage and printing a label. Sending an order confirmation, a shipping notice with tracking, and a note if your box is held for weather. Answering your message. Publishing a review you chose to post. Telling you a plant is available if you asked to be told. Keeping the records tax law requires me to keep.
That is the whole list. None of it is used for advertising, and nobody here is scored, ranked or profiled.

5. Who else sees it. Only the services it takes to get a box to you, and each one gets only the part it needs.

• Stripe, for payment. They take the card details directly; what comes back to me is that it was paid, and the address you gave them.
• The email service this store is set up with, for order confirmations, shipping notices and hold notices. It gets the address the message goes to and the message.
• Shippo and the postal carrier, for postage and delivery. They get the delivery address, which is unavoidable — it is the thing printed on the box.
• The company hosting this site, which runs the machine everything sits on.

Each of those works to my instructions, on my behalf. None of them is an audience for your information, none of them is paid in it, and there is nobody else. Merch is printed in runs and kept here rather than made to order elsewhere, so no outside printer is ever handed your address. If I ever add a service that would see your information, this section changes before it does.

6. Cookies, and what is kept in your browser. This site sets three cookies. All three are first-party, all three do a job somebody asked for, and none of them follows anyone anywhere.

• my_admin — my own sign-in to the back office. A shopper never gets it.
• my_client — a random signed number handed out on my sign-in page, so a stranger's wrong passwords cannot lock me out of my own store. It exists only on that page. A shopper never gets it either.
• my_order — set when you look up your own order, so you do not have to type your email address again for the next thirty days. There is a "Forget this order" button on that page which clears it.

Your cart lives in your own browser's storage rather than on my server or in a cookie, and it does not leave your device until you press Checkout.
There is no cookie banner on this site because there is nothing to consent to: no advertising cookie, no analytics cookie, and no third-party cookie of any kind.

7. Tracking, analytics, and Do Not Track. There are no analytics on this site. No Google Analytics, no advertising pixel, no heatmap, no session recorder, no third-party script of any kind. Nothing on this page loads from anybody else's server, and nothing about you is measured.
So: no third party collects any information about what you do here, and nothing here follows you to any other website — because there is nothing installed that could.
Which means there is nothing for a browser's Do Not Track signal, or a Global Privacy Control signal, to switch off. This site does not track you across other websites whether you send one of those signals or not, and the answer is the same either way.
A plain count of page views is built into this software, and it is switched off. It would count nothing about a person — a day, a page, a number, and no way back to anybody — but while this section says there are no analytics, it stays off, because turning it on would make that sentence untrue. If it is ever turned on, this page is rewritten first and says so plainly.

8. Selling and sharing. Mysterious Yard LLC does not sell personal information, and does not share it for cross-context behavioural advertising. Those are the two things California means by "sell" and "share", and neither has ever happened here — about anybody, of any age, ever. There is no "Do Not Sell or Share My Personal Information" link on this site because there is nothing to opt out of. If that ever changes, this section changes with it and the link appears right here.

9. How long it is kept. Nothing on this site deletes itself on a timer, so this is a list of what is kept and why rather than a list of countdowns.

• Paid orders — kept. They are the sales records a California seller has to be able to produce, and they are what the books are built from.
• The email address and phone number on an order — deleted on request, even though the order itself stays. Section 10.
• Contact messages — kept until I delete them, which is usually once they are dealt with. Ask and they go sooner.
• Reviews — published until you or I take one down.
• Waiting-list sign-ups — deleted when you ask. The one thing kept is the record that you asked to stop being emailed, because that record is the only thing stopping a form emailing you again.
• The anti-flooding counters in section 2 — deleted inside a day, automatically.
• Photographs sent with a claim or a correction — held as evidence. Ask and they are deleted for good.

10. Your rights, and what I will actually do. Ask me and I will tell you what I hold about you and where it came from, send you a copy of it, correct anything that is wrong, and delete what I am able to delete. Asking costs nothing and changes nothing: same prices, same service, same everything, whether you ask or not.
Deletion has one honest limit, and I would rather you knew it now than at the time. A paid order is a tax record. The name, delivery address, items and amounts on it stay, because a California seller has to be able to produce them. Everything else about you goes — the email address and phone number on every order, the email held against a review, the email on a contact message, the waiting-list rows apart from the one in section 9, and the name and email address on the customer record itself. That record holds no address of its own — the only delivery address here is the one on the order, and that is the part I have just said stays.
You are told in writing exactly what was removed and exactly what was kept and why. Nothing is quietly held back.

11. How to ask. Use the contact page, linked in the footer of every page. Pick "Other" as the subject, start the message with "Privacy request", and say which of the four things in section 10 you want.
I reply to the address the request came from. If that address is not on an order here, I will ask for enough detail to match a record before handing anything over — otherwise a right to know would be a way for a stranger to read your order history. Somebody may act for you if you tell me in writing that they can.

12. Children. This store is not aimed at children, and nothing here is knowingly collected from anybody under 16. If you think a child has sent me something, say so on the contact page and I will delete it.

13. Photographs. Three kinds, three different rules, because they are not the same thing.

• Review photographs are published, if you ticked the two boxes and once I have looked at the picture myself. Every image sent here is re-encoded on arrival, which removes the GPS coordinates and camera data your phone writes into the file. That happens before anything is written to disk, so the original never lands on the machine at all.
• Photographs sent with a damage claim are evidence on that claim. They are never published.
• Photographs sent with a correction, or to help identify a plant — for my eyes, so I can get a page right. Never published either, and there is no path in this software that could publish one.

Ask, and any of them is deleted.

14. Changes to this notice. If something material here changes, the "Last updated" date at the top changes with it and the new version is posted on this page. If a change would mean using information already collected for something new, I will not apply it backwards without telling you first.

15. Contact. Privacy questions go through the contact page in the footer. I am the person who reads it.