Privacy Policy

Introduction

TwinkleGear, an assumed business name of Josh Preston, sole proprietor ("we," "us," or "our"), operates twinklegear.com. This Privacy Policy explains what we collect, where it goes, how long we keep it, and what we never do with it. We ship only within the United States and the site is intended for US customers.

Information We Collect

Information You Provide

• Account: your email address, and a display name if you set one
• Orders: the name and US shipping address you enter at checkout, your email address, and what you ordered
• Payment: handled entirely on Stripe's hosted checkout page — card numbers are never entered on, sent to, or stored by us
• Newsletter: your email address, if you subscribe to the TwinkleTribune
• Suggestions & support: whatever you write when you submit a suggestion or contact us
• Blinki chat: the messages you type to our chat assistant

Collected Automatically

• Request data: Cloudflare, which hosts and protects the site, processes standard request information (IP address, browser user agent, page requested, timestamp) to serve pages and block abuse
• Abuse prevention: newsletter signups and suggestion submissions are stored with a one-way hash of your IP address, not the address itself; short-lived rate-limit counters keyed to an IP expire within minutes

Sparkles, Twinkles & TwinkleTown

If you have an account, we keep a record of your activity in the digital collectible features so your collection and balance stay accurate:

• Sparkle balance: your current balance and lifetime amount earned
• Sparkle transactions: a log of every Sparkle change — amount, reason (mystery box, fusion, TwinkleTown sale or purchase, bonus), a reference to the related item or order, and the time
• Twinkles you own: each Twinkle's generated art data, rarity, how you got it, any name you give it, and when it was minted
• Mystery Boxes: which box type you opened, whether you paid with money or Sparkles, the Twinkle you received, and any bonus Sparkles
• TwinkleTown: your listings and purchases — the Twinkle listed, the Sparkle price, status, and the buyer and seller accounts involved

Sparkles are an in-app score with no cash value. They cannot be bought with money, sold, withdrawn, or exchanged for cash, and this record is kept for your account history and for fraud prevention — not for advertising or profiling.

Cookies & Local Storage

Browsing this site sets no cookies. Everything below is strictly necessary to do something you asked for, and none of it is used for advertising, profiling, or cross-site tracking — which is why you are not asked to click through a consent banner.

Cookies

• tg_session — set only after you sign in. It keeps you signed in and nothing else. HttpOnly, Secure, SameSite=Lax, expires seven days after sign-in, and is cleared when you log out.
• Cloudflare security cookies — Cloudflare may set its own strictly necessary cookies when it needs to verify that a request (for example, the Turnstile bot check at checkout) is not automated. We do not control or read their contents, and they are not advertising cookies.

Storage in your browser

These stay in your browser and are never sent to us automatically the way a cookie is:

• Cart — your cart contents, so they survive a page reload until you check out or empty the cart
• Dismissal flags — small markers remembering that you closed the announcement bar or the account banner, so we stop showing them
• Blinki conversation ID — a random ID for the current tab so Blinki can follow the thread of your conversation; it is discarded when you close the tab

Clearing your browser storage clears all of these. Signed-in staff using our internal admin pages also hold a short-lived access token in their browser session.

Analytics

When we enable analytics, we use Cloudflare Web Analytics, which is cookieless, does not fingerprint your device, and reports aggregate page performance rather than identifying individual visitors. We use no advertising, retargeting, or social-media tracking pixels of any kind.

How We Use Your Information

• Process and fulfill orders
• Send order confirmations, shipping updates, and delivery notifications
• Sign you in and keep your account, collection, and Sparkle balance accurate
• Answer support questions and chat messages
• Process payments and refunds
• Send the TwinkleTribune newsletter, if you asked for it
• Monitor site security, prevent abuse, and diagnose errors
• Comply with legal, tax, and accounting obligations

Third-Party Services

These companies process data on our behalf so the site can work. Each receives only what its job requires, and each has its own privacy policy and retention schedule that we do not control.

How Long We Keep Things

• Sign-in links: expire 15 minutes after being sent and can only be used once
• Login sessions: expire seven days after sign-in, and are deleted immediately when you log out
• Blinki chat history: stored for 24 hours and then deleted automatically
• Rate-limit counters: expire within minutes
• Newsletter subscription: kept until you unsubscribe, which deletes the record
• Account, collection, Sparkles, and TwinkleTown records: kept while your account exists, or until you ask us to delete them
• Orders: kept for as long as we need them to support the order and to satisfy tax and accounting record-keeping obligations, which can outlast an account deletion request

What We Do NOT Do

• We do not sell or rent your personal information
• We do not use advertising, retargeting, or cross-site tracking pixels
• We do not share your info with third parties for their own marketing
• We do not receive or store card numbers
• The site is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, email us and we will delete it.

Your Rights

You may ask us to access, correct, or delete your personal information. The unsubscribe link at the bottom of our emails removes your address from the TwinkleTribune newsletter list; order confirmations and shipping updates for orders you placed still get sent. Requests are handled by a person, not an automated system — email support@twinklegear.com and we will confirm when it is done.

Changes to This Policy

If we change what we collect or who we share it with, we will update this page and the "Last Updated" date above.