privacy.
Deafiant is a small, Deaf-owned shop, built the way we'd want one built for us: require only the minimum we need to make and ship your order, keep nothing, and never sell you out. This is the honest list of what we collect when you shop, subscribe, or just look around, and what each piece is for and how you can manage it.
what we collect
Your order, when you buy. Checkout runs on Stripe's own hosted page, not ours. Stripe collects your email, name, billing and shipping address, and card details there. Your card number never touches Deafiant's servers. We never see it, store it, or log it. What comes back to our side is only the shipping name, address, and email needed to fulfill the order, plus confirmation that payment cleared.
Fulfillment hand-off. Deafiant is print-on-demand: every piece is made to order by Printful. To make and ship it, we pass your name, shipping address, and email to Printful. We don't keep our own copy. Once the order is placed with Printful, our servers hold nothing about it. There's no Deafiant account, no order history, no customer database. The one thing we hold, briefly: an opaque delivery marker (the order reference only, never your name, address, or email) that expires on its own within 4 days, kept so a payment processor retry can't send you the same confirmation email twice.
Email, if you subscribe. If you sign up for the dispatch, we ask for your email and hand it to Buttondown, who host the list. That address is the only thing the signup collects.
Pageviews. When you load a page, our server records one event to Cloudflare's Analytics Engine: which page (the path only, no query strings), which country (Cloudflare derives this from your IP before our code runs), and a counter. No IP address stored, no cookies, no browser fingerprint, no third-party tracking script.
Your cart lives in your own browser (localStorage), not on our servers. It holds product references (which item, size, color, quantity) and never your name, address, or payment details. At checkout, only the product IDs and quantities are sent to open the Stripe session.
Operational logs. If your browser blocks something because of our security policy, it may send a small report describing what was blocked (which rule, which resource), not who you are; those rotate out of Cloudflare's logs automatically. Order-handling errors are logged with personal details stripped out before anything is written.
how and why we use it
To take payment and ship your order. Stripe processes the payment and Printful makes and ships the goods. Both are necessary to give you the thing you bought. In GDPR terms that's performance of a contract; we can't fill an order without a name, an address, and a cleared payment.
To tell you about your order. We use the email you gave Stripe to send you an order confirmation, and a shipping email with the tracking number once your package is on its way. Those go out through Cloudflare, our host. They're part of filling your order (contract again), not marketing, and the address isn't added to any list.
To send the dispatch. We email you only because you asked us to. The lawful basis is your consent, and you can withdraw it in one click (see your rights, below).
To understand the shop. Pageview counts tell us which pieces and pages people actually look at, so we can make better ones. It's aggregated by path and country; we can't tie a visit back to a person and we don't try. The basis here is our legitimate interest in running and improving the shop, weighed against a deliberately tiny data footprint.
what we never do
- We never store or even see your card details. Stripe handles all of it.
- We keep no server-side copy of your order, address, or purchase history. No profiles, no customer database.
- We don't sell, rent, or hand your data to anyone. We only pass your data to the processors below that actually fulfill your order.
- We set no advertising cookies and run no cross-site trackers.
do-not-track and global privacy control
Deafiant honors Do Not Track (DNT: 1)
and Global Privacy Control
(Sec-GPC: 1) for any optional, client-side analytics.
The basic server-side pageview counter (path + country) runs before
your browser tells us anything, though, but it's cookieless and
aggregate by design. If you'd rather nothing land at all, a network
blocker (Brave Shields, uBlock Origin) stops the page from phoning home.
third parties
Four services handle data to make the shop work, each under its own privacy policy:
- Stripe runs checkout and processes payment. They collect your card, name, billing and shipping address, and email on their hosted checkout page. stripe.com/privacy (opens in a new tab).
- Printful prints, packs, and ships your order. They receive your name, shipping address, and email to fulfill it. printful.com/policies/privacy (opens in a new tab).
- Buttondown hosts the dispatch list. When you subscribe, they receive and store your email, and see your IP and browser at submit time. buttondown.com/legal/privacy (opens in a new tab).
- Cloudflare hosts the site, runs the pageview counter, and secures the connection. They see your IP (to derive the country) and your requests before our code does. cloudflare.com/privacypolicy (opens in a new tab).
We keep no order data ourselves. Stripe and Printful are the ones holding your purchase details after checkout, and each as its own data controller for that information.
your rights
- Unsubscribe: every dispatch email has a one-click unsubscribe in its footer.
- Delete your data: email hello@deafiant.com. We'll remove your email from Buttondown and relay a deletion request to Stripe / Printful for any order details they still hold, then confirm.
- Know what's held: same address. We'll tell you exactly what exists and where, which for most visitors is just an email on the dispatch list (we hold no order records ourselves).
- Correct an error: wrong email, a typo, a bad address on an in-flight order? write us and we'll fix it or relay it to Printful if/while the order can still be changed.
- Opt out of analytics: turn on Do Not Track or Global Privacy Control, or use a network blocker. We honor both.
No account, password, or ID required. The only proof we need is access to the email address itself or your order number for an order question.
scope
This policy covers deafiant.com. The other BRAINWORM sites carry their own scope and their own terms; see each site for details.
updates
When this policy changes, the new version replaces this page. We don't keep public version history yet. If you need the policy as it stood on a certain date, write us and we'll send a copy.
contact
hello@deafiant.com: for privacy questions, data requests, and everything else. The person reading it is the person who'll handle it.
Effective 2026.07.17. We update this page when the policy changes materially.