Privacy Policy.

Information Automatically Collected

When you visit the Site, we automatically collect certain information about your device, including:

• Device Data: Web browser details, IP address, device type, operating system, referring URLs, and time zone.
• Tracking Technologies: Cookies, local storage, log files, web beacons, and pixels that track how you browse the Site, what products you view, and what search terms led you here.

Information Provided Voluntarily

When you sign up for our founding backer list, contact us, or make a purchase through the Site, we collect specific information from you, including:

• Identity & Contact Data: Your name, billing address, shipping address, email address, and phone number.
• Submission Data: Messages you send through our contact form, and any preferences you share when joining our founding backer or newsletter lists.
• Account Data: If you create an account, your email address and authentication credentials (passwords are stored only in hashed form by our authentication provider).
• Payment Data: Payment information (including credit card numbers, PayPal, or alternative payment methods). Payment processing is handled securely by our third-party provider (e.g., Stripe), and we do not store your raw financial details.

A cookie is a small data file placed on your device when you visit a website. We and our service providers use cookies and similar technologies for the following purposes:

• Strictly Necessary: Required for the Site to function, including maintaining your shopping cart, keeping you signed in, and remembering your session.
• Performance & Analytics: Help us understand how visitors use the Site so we can improve it (e.g., Google Analytics).
• Functional: Remember choices you make, such as region or preferences.
• Advertising: Used by our advertising partners to build a profile of your interests and show you relevant ads on other sites.

You can control cookies through your browser settings and most devices allow you to refuse or delete cookies. Note that disabling certain cookies may affect the functionality of the Site (for example, your cart may not persist between visits).

We use the information we collect to:

• Process your payment information and fulfill orders placed through the Site.
• Arrange for shipping and provide you with invoices and order confirmations.
• Communicate with you regarding your order, your account, or your submissions.
• Send you information or advertising relating to our mahjong products, in accordance with the preferences you have shared with us.
• Screen orders and form submissions for potential risk or fraud (in particular, your IP address).
• Improve and optimize the Site, including by generating analytics about how customers browse and interact with it.
• Comply with our legal obligations and enforce our terms.

We share your Personal Information with third parties to help us use your Personal Information, as described above. These third parties act as service providers on our behalf and are contractually obligated to protect your data:

• E-commerce Platform: We use Shopify (or alternative e-commerce providers) to power our online store. You can read more about how Shopify uses your Personal Information here: shopify.com/legal/privacy.
• Hosting & Backend: Our website is hosted on cloud infrastructure and uses a managed database and authentication service to securely store form submissions, account information, and other Site data.
• Email & Communications: We use third-party email providers to deliver transactional and marketing emails you have opted into.
• Analytics: We use Google Analytics to help us understand how our customers use the Site. You can opt out of Google Analytics here: tools.google.com/dlpage/gaoptout.
• Payment Processing: Card payments are processed by PCI-compliant providers such as Stripe or Shopify Payments. We do not see or store your full card number.
• Compliance: We may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request, or to otherwise protect our rights.

As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you regarding our mahjong collections, sales, or community updates. For more information about how targeted advertising works, you can visit the Network Advertising Initiative's educational page at networkadvertising.org.

You can opt out of targeted advertising by using the links below:

• Facebook: facebook.com/settings/?tab=ads
• Google: google.com/settings/ads/anonymous
• Bing: advertise.bingads.microsoft.com

Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance's opt-out portal at optout.aboutads.info.

Please note that we do not alter our Site's data collection and use practices when we see a Do Not Track signal from your browser.

Depending on your location, you may have specific data privacy rights, including:

• Access & Portability: The right to access personal information we hold about you and to receive it in a portable format.
• Correction & Deletion: The right to ask that your personal information be corrected, updated, or deleted.
• Opt Out: The right to opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us directly.
• Non-Discrimination: California residents have the right not to receive discriminatory treatment for exercising their privacy rights under the CCPA.

If you are a European resident, please note that we are processing your information in order to fulfill contracts we might have with you (for example, if you make an order through the Site), or otherwise to pursue our legitimate business interests listed above. Your information will be transferred outside of Europe, including to Canada and the United States.

To exercise any of these rights, please contact us using the details in Section 11.

When you place an order through the Site, we will maintain your Order Information for our records unless and until you ask us to delete this information. Founding backer and newsletter submissions are retained until you unsubscribe or request deletion. Contact form messages are retained as long as reasonably needed to respond and maintain a record of correspondence.

We use industry-standard safeguards to protect your information, including encryption in transit (HTTPS/TLS), encrypted database storage, hashed password storage, and access controls that restrict who can view submissions on our side. No method of transmission over the Internet is 100% secure, but we work to protect your information using reasonable commercial standards.

The Site is not intended for individuals under the age of 13 (or the equivalent minimum age in the relevant jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons. When we do, we will update the "Effective Date" at the top of this page.

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by email or by mail using the details below:

• Email: team@boneandbam.com
• Mailing Address: 3825 Birchwood Dr, Boulder CO 80304