Privacy Policy

Who we are

Stitch and Go runs masonictshirts.com under the Masonic TShirts brand, a United States store selling made-to-order printed apparel. You can reach us at support@masonictshirts.com. This page explains what information we collect when you browse or buy, why we collect it, who handles it for us, and the choices you have. If anything here is unclear, send us a message through the contact form and a person will answer.

What we collect, and why

To fulfill your order. Your name, email address, shipping address, the items you bought, and your order history. We need these to print your shirts, deliver them, and help you if something goes wrong.

Payment. Payments are handled by Stripe. You enter your card details into Stripe’s secure form, and the card number never reaches our servers. We only see the payment status, the totals, and a reference number.

When you contact us. We keep the emails you send so we can answer them and remember the context next time.

If you join the newsletter. Just your email address, used for the occasional update you signed up for. Every message has an unsubscribe link.

Technical basics. Like nearly every website, our servers keep short-lived request logs (IP address, browser type, pages requested) for security and troubleshooting.

Accounts without passwords

Placing an order creates a simple account tied to your email address. There is no password. To sign in, we email you a one-time link that expires quickly and can only be used once. Our database stores a fingerprint of that link rather than the link itself, so it cannot be reused even in the worst case.

Who processes data for us

We share personal information only with the services needed to run the store, and each one gets only what its job requires:

• Stripe for payment processing and fraud prevention.
• EasyPost and the delivery carrier you choose at checkout (USPS or FedEx) get your name and shipping address to price, label, and deliver your parcel.
• Amazon Web Services for hosting, storage, and the email system behind order confirmations and sign-in links. Data is stored in the United States.
• Cloudflare for content delivery and protection against malicious traffic.

We do not sell your personal information. We do not give it to anyone for their own marketing.

Cookies

Our own cookies are few:

• fm_cart remembers your cart between visits. The store cannot work without it.
• fm_customer keeps you signed in after you use a sign-in link.
• Stripe sets its own cookies inside the secure checkout to process payment and prevent fraud.

When we run advertising or analytics (Google Analytics, Google Ads, Meta, TikTok, or Microsoft Advertising), those platforms may set their own cookies to measure visits and purchases. You can block them with standard browser settings or extensions, and shopping and checkout will still work. Google and other ad companies may use their cookies to show you ads based on earlier visits to this site. You can turn that off for Google in Google’s ad settings, and for many ad companies at once on the Network Advertising Initiative opt-out page.

To measure which ads lead to real orders, we may also report a completed purchase to Google and Meta directly from our server, along with the ad click identifiers their cookies set and one-way hashed (SHA-256) versions of the details you gave at checkout. For Meta that means your email, first and last name, phone number, and the city, state, postcode and country of the delivery address, plus an identifier for your account with us that means nothing outside this store. Google receives the hashed email.

A hash is one way. It lets a platform recognise a customer it already knows without us handing over anything readable, and it cannot be turned back into your details. We never send your street address, what you ordered in readable form, or any payment detail, and no ad platform ever receives a readable email, name or phone number from us for advertising or measurement. If you would rather not be matched this way, blocking the platforms’ cookies with standard browser settings stops the click identifiers, and you can write to us to ask that we exclude your orders from conversion reporting entirely.

How long we keep things

Order records stay on file for as long as we operate. They are our record of what you bought and what we owe you, and tax law requires us to keep them. Sign-in links expire within minutes. Newsletter addresses are kept until you unsubscribe. Support emails are kept while they are still useful for helping you.

Your choices and rights

Use the contact form with the email address from your order and we will show you the personal information we hold about you, correct it, or delete it. One limit applies: completed order records that the law requires us to retain will be kept, but cut off from any marketing use. Depending on where you live, including California and the EU or UK, local law may back these rights formally. We honor the requests either way.

Security

Traffic to the site is encrypted. Stored data is encrypted. Our database is not reachable from the public internet, and credentials live in a managed secrets vault rather than in application code. No system is perfectly secure, which is exactly why the most sensitive detail, your card number, stays with Stripe and out of our hands entirely.

Children

The store is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

Changes

If this policy changes in a way that matters, we will update the effective date above and say so on the site. The current version always lives at this address.

Contact

Privacy questions and requests: use the contact form. See also our Terms of Service.