Privacy Policy

Last updated: [OWNER: date this version is published]

This page explains what Team Figgins Disc Golf ("we", "us") collects when you shop at teamfiggins.com, what we do with it, who else sees it, and what you can do about it. We have tried to keep it short and plain. If anything here is unclear, ask us (see the end of this page).

1. What we collect and why

When you place an order, we collect your name, email address, billing and shipping addresses, phone number (if you give one), what you bought and what you paid. We use these to take payment, work out sales tax, ship or hand over your order, send you emails about it, and keep the records a business has to keep.

When you create an account, we also keep your password, but only in a scrambled form (a one-way hash) that nobody, including us, can turn back into the password. Your account holds your orders, your saved addresses, and any store credit and loyalty points you have.

If you had an account on our old website, your name, email address, saved addresses, order history, store credit and points were moved to this website. Your old password was not moved: you choose a new one with "Forgot password" on the sign-in page the first time you sign in.

If you bought from us on eBay or Amazon before this website opened, your order was moved here from our old website with the rest of our order history. For an eBay order we hold the name, billing and shipping addresses and (where eBay gave us one) phone number on the order, and the email address eBay gave us, which is usually a forwarding address made by eBay rather than your own. For an Amazon order we hold the forwarding email address Amazon gave us and, where Amazon passed them on, the name, city, state and ZIP code on the order, but not the street address or a phone number. These orders are not linked to an account on this website.

When you browse, our web server keeps a standard request log. For each page or file your browser asks for, it records the date and time, the page or file asked for, and the kind of browser you use. It does not record anything after the "?" in the address (such as the words you searched for), nor the page that linked you there, nor what you type into our forms, such as your password or your address. Because every visit reaches our server through Cloudflare (see section 4), it does not record your IP address either. A monitoring service, Sentry (see section 4), is also told the address of each page you open and how long it took, but not who opened it. [OWNER: confirm this on the server. In the IIS log files, the client address column should show only the tunnel's own address (127.0.0.1 or ::1) and the user name column only a dash, and there should be no cs-uri-query or cs(Referer) column once the setup script has been run again (docs/operations.md, "IIS's request log").]

We do not store your IP address in our database. Our server does use your IP address for a short time to stop people guessing passwords, gift card codes or coupon codes, and to limit how many orders one connection can place in an hour. That count looks back at most one hour, is kept only in the server's memory (cleared whenever the server restarts), and is never written to our logs or database.

Emails. We send emails about your account (confirming your address, resetting your password) and your orders, cart links and cart reminders (described below). We also send a newsletter to people who subscribe to it: when you sign up for our welcome offer (by ticking the box to get our emails about new discs, events and offers), or from the "Email preferences" page of your account. The newsletter is sent on topics, such as new discs and products, events and tournaments, and sales and offers, and you get only the topics you choose. A subscription from the welcome offer starts with every topic; you choose them yourself on your account page or with the "Manage your email preferences" link at the bottom of any newsletter, which needs no sign-in. Every newsletter also has an "Unsubscribe" link, and your mail app may show its own unsubscribe button, which works the same way. We send newsletters only after your address is confirmed: by the link we email you, or because you are signed in to your account, whose address is already confirmed. For the newsletter we keep your email address, the topics you chose, where you subscribed, when you agreed, when you confirmed and, if you stop it, when you did, so that we can show you asked for it and never send it again after you stop. Your address goes to SendGrid to deliver it (see section 4). The welcome code itself is a coupon tied to your account, for one order. [OWNER: confirm this wording.]

Our record of the emails we send. We keep a record of every email the website sends, newsletters included: the address it went to, its subject, what kind of email it was and what it was about (such as an order number), when it was sent, and whether SendGrid accepted it, refused it or could not be reached. We keep a copy of each email's text with private links and codes taken out first (password reset and sign-in links, gift card and coupon codes, and the links in a newsletter's footer). This is so that, when you ask us what we sent you or whether an email went, we can answer. Only the store's owners can see it. Each record is kept for at most 13 months (see section 8), and we delete yours if you ask (see section 7). Emails held back by our test settings are recorded the same way.

Cart links. If you ask us to put an order together for you, our staff can make a cart for you and email you a link to it. To do that we keep your email address (and, if you have an account, which account it is), the items, any prices we lowered for you, any coupon, a note from us and how you want to get your order, along with which staff member made the cart and when. The link stops working after a set time (7 days unless we tell you otherwise), once you have ordered from it, or if we withdraw it. Opening it puts the items in your cart. The email goes through SendGrid, like our other emails (see section 4).

Cart reminders. If you leave items in your cart and we have your email address (because you are signed in, or because you typed it at the first step of checkout), we may send you up to two reminders: about 4 hours later and, if you still have not come back, about 2 days later. If you come back and leave again, the count starts again, but never more than two each time you leave. We send reminders only while the store has them switched on. Every reminder has an unsubscribe link. Unsubscribing records your email address on our list of addresses that get no reminders, so we never send reminders to it again, whatever cart or account you use, until you ask us to turn them back on. The reminders do not track whether you open them or click their links. Reminders and cart links go through SendGrid like our other emails, and end with our postal address.

2. Consent

When you give us your details to place an order, create an account or arrange a delivery or return, you agree to us using them for that purpose. That includes reminding you of a cart you left (see "Cart reminders" in section 1), which you can stop at any time with the link in the reminder. If we ever want to use your details for something else, such as other marketing, we will ask you first or give you a clear way to say no.

You can withdraw your consent at any time by contacting us (see the end of this page). We will stop using your details for anything other than what we must keep by law, such as records of past orders.

3. Disclosure

We do not sell or rent your personal information, and we do not share it with advertisers.

We share it only with the service providers listed in the next section, as far as each needs it to do its job; when the law requires us to; or if you break our Terms of Service. If our business is sold or merged with another company, your information may pass to the new owners so that they can keep serving you.

4. Third-party services

We use these companies to run the store. Each has its own privacy policy, which governs what it does with the information.

• Stripe takes card payments. You type your card details into a form on our payment page that comes from Stripe, and they go straight to Stripe: they never reach our server. Stripe also receives the amount, your order number and, to help it spot fraud, details of your browser and device. If you are signed in, Stripe also receives your name and email address, so that it can offer to save your card for next time; saving a card is your choice, and you can remove a saved card on the payment page. If you pay with Apple Pay, Google Pay, Afterpay or Stripe's Link, that service handles the payment through Stripe under its own terms. Stripe's privacy policy.
• Stripe Tax works out sales tax. It receives your shipping address (or your billing address, for a pickup order) and the prices of the items, but not your name or email address.
• ShipStation works out shipping prices at checkout from the carriers' rates. It receives the street, city, state and ZIP code of your shipping address and the size and weight of the parcels your order would ship in, but not your name, email address or phone number.
• SendGrid (part of Twilio) delivers our emails, newsletters included. It receives your email address and the content of each email, which can include your order and address, so it holds the address of each newsletter subscriber and each newsletter sent to them. SendGrid tells us when an email to your address bounces, is dropped because SendGrid will not deliver to that address, or is reported as spam, and when you unsubscribe through your mail app; with each report we get the address and, for a newsletter, which subscriber and which newsletter it was. We record that against your address so that we stop sending you newsletters. We have turned off SendGrid's email open and link-click tracking, and its own unsubscribe links, for every email, newsletters included. Twilio's privacy policy.
• ShippingEasy prints our shipping labels and packing slips. When we ship your order through ShippingEasy, it receives your name, email address, phone number, billing and shipping addresses, what you ordered and what you paid, and any note you left with the order. Pickup orders are not sent to it.
• eBay and Amazon. If you buy from us on eBay or Amazon, that marketplace's privacy policy applies to your purchase, and the marketplace passes us your order. What we hold from past eBay and Amazon orders is described in section 1. [OWNER: at cutover, say what this website keeps from new marketplace orders. The eBay connection is not built yet; as planned, we would keep only your eBay username and the name on the order, and your shipping address would go from eBay to ShippingEasy for the label, not to us. Amazon's part is not settled; describe it once the Amazon connection is built.]
• Cloudflare sits in front of our website to keep it fast and secure, so every visit passes through it. It sees your IP address, your browser's details, and the pages and forms that pass between you and us. Cloudflare's privacy policy.
• Sentry tells us when the website hits an error or is slow, so that we can fix it. For each page you open, it receives the page's address (without anything after the "?", so not the words you searched for), how long the page took our server to make, and your browser's type and language. When a page fails, it also receives the error. Before anything is sent, we remove your IP address, cookies, who is signed in and anything you typed into a form, so these records do not say who you are. Very occasionally an error's own text includes a detail such as an email address. Sentry's privacy policy.
• Backups. A copy of our database, including customer and order details, is kept in [OWNER: OneDrive or Google Drive, whichever the backups use] so that the store can be restored if the server fails.
• An AI assistant. The store's owners can connect an AI assistant to the back office, to look things up and to make some changes for them. When an owner asks, it can see customers' names, email addresses, store credit and points, gift cards, coupons and the orders that used them, cart links made for customers, stock, and orders (what was bought, when, its status, payments and shipments, but never a delivery or billing address or a phone number). On an owner's instruction it can also change stock, prices and product details, add to or take from a customer's store credit or points, issue, adjust, cancel or re-send gift cards, make coupons, build a cart for a customer and email them a link to it, show or hide a product in the shop, and move an order through fulfilment (mark it ready for pickup, picked up or completed, hold or release it, record a shipment or send it to the shipping service). Where the back office records who made a change (stock, orders, store credit, points, gift cards, coupons, cart links, counts and redirects), its changes are recorded under that owner's name, like changes made by hand; a price, a product's details and whether a product is shown are recorded by the time they changed, as they are for changes made by hand. It cannot see card details, which we never have. [OWNER: name the assistant and its company (for example, Claude by Anthropic), and confirm that its terms do not let the company use this information to train its models.]

Some of these companies are based in, or store information in, a different state or country from you, and the information is then subject to the laws of that place.

Links. Links on our site can take you to other websites, such as YouTube or a tournament's registration page. We are not responsible for what those sites do with your information; read their privacy policies.

5. Security

Our website only works over an encrypted connection (HTTPS). Card details go directly from your browser to Stripe and never pass through or rest on our server. Passwords are stored only as one-way hashes. Accounts lock for 15 minutes after five wrong passwords, and staff accounts need a code from an authenticator app as well as a password. No method of sending or storing information is completely secure, but we take reasonable steps to protect yours.

6. Cookies

A cookie is a small piece of text a website asks your browser to keep. We use cookies the store needs to work, cookies that remember choices you make, and one that stops our welcome offer appearing twice. If you block cookies, you can still browse, but the cart and signing in will not work.

Optional Google Analytics. Only after you choose Allow analytics, Google Analytics 4 receives page views and shopping events, public product IDs and names, quantities and amounts, and the number of a confirmed order. Google also receives technical information from your browser, including your IP address, to process these visits. We do not send customer names, email addresses, phone numbers, addresses, payment or account tokens, or raw search queries. Advertising storage, advertising user data and ad personalization are denied. You can decline without affecting the store, or change your choice using Analytics preferences in the footer. Global Privacy Control blocks collection. Google's privacy policy.

tf-analytics-consent

Remembers your Allow analytics or Decline choice for up to 180 days. Set only when you choose.

_ga and _ga_…

Google Analytics cookies, set only after you allow analytics. They distinguish browsers and visits, and last for up to 180 days from the last visit. Declining later removes these cookies and reloads the page without Google Analytics.

tf_cart

Remembers your cart. Set when you first add something to it (or follow one of our coupon links), and kept for 30 days from the last change. It holds a random code that points to your cart on our server, nothing else. Carts left unchanged for 30 days are deleted.

tf-theme

Remembers whether you chose the light or dark look, using the switch in the header or footer. Set only when you choose one, and kept for a year. Choosing "Device" (follow your device's own setting) deletes it.

tf_welcome

Remembers that this browser has been shown our welcome offer (the panel offering money off for signing up to our emails), so that it is shown only once. Set the first time the offer appears, and kept for a year. It holds only the number 1.

.AspNetCore.Antiforgery.… (the name ends in a code)

Security: stops another website from submitting our forms (adding to the cart, checking out, signing in) on your behalf. Deleted when you close your browser.

.AspNetCore.Identity.Application

Keeps you signed in. Deleted when you close your browser, unless you tick "Keep me signed in": then it lasts 14 days, renewed while you keep using the site. Signing out deletes it.

Identity.TwoFactorUserId

Staff only: remembers who is signing in between the password and the authenticator code. Lasts a few minutes.

Identity.TwoFactorRememberMe

Staff only: set when a staff member ticks "Remember this browser for 30 days", so they are not asked for a code on that browser again. Lasts 30 days.

Two other companies may set cookies of their own. On the payment page, Stripe's form may set cookies to help detect fraud (see Stripe's cookie policy). [OWNER: Cloudflare sets a security cookie such as __cf_bm only if its bot protection is turned on for the site; check the Cloudflare dashboard and either name it here or delete this marker.]

7. Your account and your choices

When you are signed in, the My account pages let you see your orders (including those from our old website), your saved billing and shipping addresses, and your store credit and loyalty points with their history. You can change your name, email address (we send a link to the new address to confirm it), password and saved addresses there at any time.

If you ordered as a guest and later create an account with the same email address, your earlier orders appear in your account once you have confirmed that address.

To stop cart reminders, use the unsubscribe link at the bottom of any reminder; you do not need to sign in. To have them turned back on, or if you have lost the email, contact us (see the end of this page).

To change which newsletter topics you get, or to stop the newsletter, use the links at the bottom of any newsletter (no sign-in needed), or the "Email preferences" page of your account. Our other emails are about your account and your orders, or are a cart link you asked us for, and cannot be unsubscribed from.

You cannot delete your account yourself on the website. To have it deleted, or to ask what we hold about you, correct it, or ask us to stop using it, contact us (see the end of this page). We will delete your account, but we keep the records of orders you have placed for as long as we need them for accounting and tax: [OWNER: how long].

When we delete your information at your request, we also delete our record of the emails we sent you (to every address of yours we know of), keeping only a note that we deleted some, when, and how many. Copies already in our backups are removed as those backups expire (see section 8).

8. How long we keep information

• Carts: deleted 30 days after they were last changed.
• Cart links: deleted 90 days after they stop working (they expire, are withdrawn, or you order from them). An order placed from one keeps its own record.
• The list of email addresses that have unsubscribed from cart reminders: kept until you ask us to remove yours, since it is what stops us sending you more.
• Newsletter subscriptions: kept until you unsubscribe. An unsubscribed address, or one we stopped sending to because its emails bounced or were reported as spam, is kept so that we never email it again unless you subscribe again. [OWNER: confirm these periods.]
• The record of which newsletter was sent to which subscriber, and whether it bounced, was reported as spam or led to an unsubscribe: deleted 13 months after the newsletter was sent. The newsletter itself and its totals (how many were sent, bounced and so on) are kept. [OWNER: confirm this period.]
• Our record of the emails we send (see "Our record of the emails we send" in section 1): each email's record is kept for at most 13 months from when it was sent, then deleted by a daily cleanup. The record has a fixed amount of space, so if it ever fills up, the oldest records are deleted sooner.
• Our website's own logs: kept for 30 days. They record what the site did (for example, "user 123 changed their address"), not passwords, card details or the contents of your address.
• Our web server's request log (see "When you browse" in section 1): kept for 30 days. Older files are deleted every day.
• The error reports and page timings Sentry holds for us: [OWNER: how long; it depends on your Sentry plan].
• The counts used to stop password and code guessing: they look back at most an hour, and live only in the server's memory until it restarts.
• Backups of the database: 7 days on our server; the copies in [OWNER: the backup drive] are kept [OWNER: how long].
• Accounts and orders: [OWNER: how long, for example "accounts until you ask us to delete them, order records for 7 years"].

9. Age of consent

By using this site, you confirm that you are an adult where you live, or that you are an adult and have given permission for a child in your care to use it. Our site is not aimed at children under 13, and we do not knowingly collect information from them.

10. Changes to this privacy policy

We may change this policy from time to time, so please check it now and then. Changes take effect when we publish them here, and the date at the top of the page shows when it last changed. If we make a significant change to what we collect or who we share it with, we will say so clearly on this page.

Questions and contact information

To see, correct or delete the personal information we hold about you, to make a complaint, or just to ask a question, email us at [email protected] or write to us at:

Team Figgins
1767 Lakewood Ranch Blvd
Ste 151
Bradenton, FL 34211