Privacy Policy
> cat ./legal/privacy.md
last_modified: October 18, 2026
Nerd Rage Studio is a sole proprietorship operated from Detroit, Michigan.
We need some personal information to run the shop, build custom art, send orders, and keep random internet goblins out of customer accounts. We do not collect personal information for sport, sell it to data brokers, or use it for targeted advertising.
This policy explains what we collect, why we collect it, who helps us process it, and what you can ask us to do with it.
WHAT THIS POLICY COVERS
This policy applies when you:
Visit nerdrage.studio
Create or use an account
Place an order
Request a custom commission
Upload reference images
Contact the studio
Subscribe to the newsletter
Use any other feature that links to this policy
Third-party websites linked from Nerd Rage Studio, including Discord and social media platforms, have their own privacy practices. Once you leave our digital basement, their rules apply.
INFORMATION YOU GIVE US
Account Information
When you create an account, we may collect:
Your name
Email address
Email-verification status
Profile image
Account creation and update dates
Your account role
Whether two-factor authentication is enabled
A link between your account and your shop customer record
Passwords are stored as secure hashes. We cannot read your password because that would be both creepy and catastrophically stupid.
If you use two-factor authentication, we store the authentication secret and backup-code information needed to provide that feature.
Google & Discord Sign-In
If you sign in using Google or Discord, we may receive information authorized by that provider, such as:
Your provider account identifier
Name
Email address
Profile image
Authentication tokens needed to maintain the connection
We use this information only to create, connect, and secure your Nerd Rage Studio account.
Google and Discord process information under their own privacy policies.
Orders & Checkout
When you place an order, we may collect:
Your name
Email address
Phone number
Shipping address
Billing address
Items purchased
Cart contents
Order history
Payment status
Shipping method
Tracking information
Customer-service and return records
Your cart may be stored both in your browser and in our commerce system. Signed-in carts may be connected to your account.
We do not store your full payment-card number or CVC.
Payments & Fraud Prevention
Payments are processed through Stripe.
Checkout may send Stripe:
Your name
Email address
Phone number
Shipping address
Billing address
Order amount
Payment method
Device and transaction information
Fraud-prevention signals
Stripe.js and Stripe Radar may collect technical and transaction information used to prevent fraud, verify addresses, evaluate payment risk, and request additional authentication such as 3D Secure.
Depending on your device and Stripe’s availability, checkout may offer Apple Pay, Google Pay, Link, PayPal, or other supported payment methods. If you select one of these services, that provider may process information according to its own privacy policy.
The payment companies get the sensitive payment details. We get confirmation that you paid. This arrangement is better for everyone.
Commission Requests
When you request a commission, we may collect:
Your name
Email address
Phone number or Discord handle
Project type
Budget range
Base-item information
Project description
Requested timeline
Messages and revision feedback
Reference images and other uploaded files
Quote and invoice information
Your IP address
Browser and device information
An access token used to open your private invoice or quote
Please do not upload government identification, medical records, financial documents, or other sensitive information we did not request.
You are responsible for having permission to share any photographs, artwork, or other materials included with your request.
Contact Messages
When you contact us, we collect the information included in your message, along with your name, email address, and any files or contact details you choose to provide.
Newsletter Signups
When you subscribe to the newsletter, we collect your email address and subscription status.
Newsletter broadcasts and subscription records are managed through Resend. You can unsubscribe using the link in any marketing email or by contacting us.
Unsubscribing from marketing messages does not stop order receipts, password resets, commission invoices, or other messages needed to provide a service you requested.
INFORMATION COLLECTED AUTOMATICALLY
Sessions & Security Records
When you sign in, we may create a session record containing:
A session token
Expiration time
IP address
Browser and device information
We also use short-lived records for password resets, email verification, email changes, and two-factor authentication codes.
Cookies & Browser Storage
The site uses technology necessary to operate the shop and customer accounts.
This may include:
A secure session cookie that keeps you signed in
Local browser storage used to remember cart contents
Server-side cart and checkout records
Security tokens used to prevent unauthorized activity
Blocking necessary cookies or browser storage may prevent account, cart, or checkout features from working correctly. The machine cannot remember you if you remove its tiny digital sticky notes.
Server Logs
Our hosting and infrastructure providers may automatically record:
IP address
Browser type
Device information
Page requested
Date and time of the request
Error and performance information
Security and fraud signals
We use these records to operate, troubleshoot, and protect the site.
ANALYTICS & ADVERTISING
Nerd Rage Studio does not currently use Google Analytics, advertising pixels, behavioral advertising systems, or cross-site tracking tools.
We do not currently sell or share personal information for targeted advertising.
We may add privacy-focused analytics in the future to understand basic information such as page views, referral sources, device types, and general traffic patterns. We will update this policy before enabling a new analytics provider and will request consent where required.
We are interested in knowing whether the shop works, not constructing a twelve-season psychological profile of everyone who looks at a cool jacket.
HOW WE USE INFORMATION
We use personal information to:
Create and manage customer accounts
Verify email addresses
Secure accounts and provide two-factor authentication
Process payments
Detect and prevent fraud
Complete and ship orders
Provide tracking and delivery support
Handle returns, exchanges, and store credit
Review, quote, and produce custom commissions
Send mockups, invoices, updates, and approval requests
Respond to messages and customer-service requests
Send newsletters when someone has subscribed
Maintain tax, accounting, and business records
Investigate disputes, chargebacks, security problems, and policy violations
Improve the reliability and security of the website
Comply with legal obligations
We do not use customer information to train artificial-intelligence models.
COMMISSION PHOTOS & PORTFOLIO USE
Unless you request confidentiality in writing before production begins, Nerd Rage Studio may photograph the finished physical artwork and display those photographs in our portfolio, on social media, or in other studio marketing.
We will not publish your name, address, private messages, submitted reference images, personal photographs, or other identifying information without separate permission.
If a commission involves sensitive personal imagery or is intended as a private gift, tell us before work begins. Surprises are fun. Accidental privacy disasters are less fun.
WHO PROCESSES INFORMATION FOR US
We share information only when needed to operate the business, complete a service, protect the studio, or comply with the law.
Current providers include:
Vercel & Railway
Vercel and Railway provide website hosting, application infrastructure, deployment, logging, and related technical services. They may process site traffic, server logs, and information submitted through the application.
Neon
Neon provides database hosting for account, order, commission, and other application records.
Cloudflare
Cloudflare provides R2 file storage and may store uploaded commission references, product assets, and related files. Cloudflare may also process technical information needed to deliver and protect stored content.
Stripe
Stripe processes payments, billing information, wallet payments, payment authentication, address verification, and fraud-prevention signals.
Resend
Resend sends transactional and newsletter email. This includes verification messages, password resets, two-factor codes, order receipts, commission messages, invoices, and newsletter broadcasts.
Resend may process recipient addresses, message content, delivery status, and technical information needed to deliver and troubleshoot email.
Veeqo
Veeqo helps create shipping labels and manage fulfillment. We may provide Veeqo with the customer’s name, shipping address, email address, phone number, order contents, package information, and tracking details.
Google & Discord
Google and Discord process information when a customer chooses to use one of those services to sign in.
Payment Wallet Providers
Apple, Google, PayPal, Stripe Link, or another available payment provider may process information when selected during checkout.
Professional Advisers
We may share information with an accountant, tax preparer, attorney, insurer, security specialist, or other professional adviser when reasonably necessary to operate or protect the business.
These providers have their own privacy terms and security responsibilities. We give them only the information reasonably necessary to perform their role.
OTHER TIMES WE MAY DISCLOSE INFORMATION
We may disclose information when reasonably necessary to:
Comply with a law, court order, subpoena, or valid government request
Enforce our policies or agreements
Investigate fraud, abuse, security incidents, or illegal activity
Protect the rights, safety, property, and security of Nerd Rage Studio, our customers, or the public
Complete a request made with your consent
Nerd Rage Studio is not intended to be sold or transferred to another owner. If the studio permanently closes, personal information that is no longer legally or operationally required will be deleted or securely disposed of. Records required for taxes, disputes, or other legal obligations may be retained for the necessary period.
We will not sell the customer list on the way out the door like some kind of data yard sale.
HOW LONG WE KEEP INFORMATION
We keep information only for as long as reasonably needed for the purpose described below, unless a longer period is required for taxes, legal claims, fraud prevention, or another lawful reason.
Paid Orders & Tax Records
Order, payment-confirmation, invoice, and tax records may be retained for up to seven years.
This does not mean every message, uploaded image, or browser log gets embalmed alongside the receipt.
Customer Accounts
Account information is retained until the account is closed or deletion is requested.
Some order, payment, fraud, tax, and dispute records may remain after account deletion when legally or operationally necessary.
Authentication Records
Active sessions remain until they expire or are revoked. Password-reset, email-verification, and similar temporary records are deleted or invalidated after expiration.
Two-factor records remain while two-factor authentication is enabled or until the account is deleted, subject to required security records.
Carts & Incomplete Checkout Records
Inactive carts and incomplete checkout records may be kept for up to 30 days unless they become part of a completed order or are needed to investigate fraud or a technical problem.
Contact Messages
General contact messages may be retained for up to two years.
Commission Requests
Rejected, abandoned, or incomplete commission requests and their uploads may be deleted after 90 days.
Accepted commission references, project files, correspondence, and production records may be retained for up to one year after completion.
Financial records associated with a paid commission may be retained for up to seven years.
Photographs of completed artwork used in the studio portfolio may remain available until removed by Nerd Rage Studio or until a valid removal request is approved.
Newsletter Records
Newsletter subscription records remain until you unsubscribe or request deletion. We may retain a minimal suppression record so we do not accidentally subscribe you again after you told us to knock it off.
Logs
Routine server, application, and security logs may be retained for up to 90 days. Records connected to fraud, abuse, a security incident, or a legal dispute may be retained longer.
Backups
Deleted information may remain temporarily in encrypted or access-restricted backups until those backups are overwritten through the provider’s normal retention cycle.
YOUR CHOICES & PRIVACY REQUESTS
You may ask us to:
Confirm whether we hold personal information about you
Provide a copy of information reasonably linked to you
Correct inaccurate account or contact information
Delete eligible personal information
Close your account
Unsubscribe you from marketing email
Remove an approved portfolio reference when reasonably possible
Explain how information was used or disclosed
Send privacy requests to privacy@nerdrage.studio.
We may need to verify your identity before completing a request. This helps prevent a random goblin from requesting your order history while pretending to be you.
We may deny or limit a request when information must be kept for taxes, payment disputes, fraud prevention, security, legal compliance, or the rights of another person.
Residents of some states may have additional privacy rights. We will honor applicable rights and provide any required appeal process.
We will not discriminate against anyone for making a legitimate privacy request.
EMAIL CHOICES
You can unsubscribe from newsletters using the link included in any marketing message.
Transactional messages are different. We may still send account-security notices, receipts, shipping updates, invoices, commission approvals, and other messages needed to complete a transaction or protect an account.
CHILDREN
The site and shop are not directed to children under 13, and we do not knowingly collect personal information from children under 13.
Anyone under 18 should use the site, place orders, or request commissions only with the permission and supervision of a parent or legal guardian.
If we learn that we collected personal information from a child under 13, we will delete it as reasonably possible. A parent or guardian may contact privacy@nerdrage.studio about a child’s information.
DATA SECURITY
We use reasonable administrative and technical measures intended to protect personal information.
These measures include hashed passwords, access controls, secure authentication sessions, optional two-factor authentication, limited provider access, and payment processing through Stripe.
No website, database, carrier pigeon, or heavily armed wizard can guarantee perfect security. Please use a unique password, protect your two-factor backup codes, and contact us if you believe your account has been compromised.
If a security incident affects personal information, we will investigate it and provide notice when required by law.
UNITED STATES OPERATIONS
Nerd Rage Studio operates from Michigan in the United States.
Our providers may process information in the United States or other locations where they operate. Their handling of information is governed by their agreements, privacy policies, and applicable law.
CHANGES TO THIS POLICY
We may update this policy when the shop, technology, providers, or legal requirements change.
The updated version will be posted here with a new effective date. If a change materially affects how we use personal information already collected, we will provide additional notice when reasonably required.
We will not quietly rewrite the rules and hope nobody notices. That is villain behavior.
CONTACT US
Privacy questions and requests:
Mailing address:
Nerd Rage Studio
[BUSINESS MAILING ADDRESS]
[CITY, STATE ZIP CODE]
United States
Questions? hello@nerdrage.studio