Privacy

We collect what we need to send you a shirt and, if you make an account, to know it is you. Not more.

Where this applies

This page covers theoriginalcigarettestshirt.com, which is the store, 100cigarettes.com, which is where the drops and the games live, and burgerperson.com, which is Burger Person. Same owner. Same systems.

What we collect

When you place an order, we collect the details needed to fulfil it: your name, shipping address, email, order contents, and a phone number if checkout asks for one. Payment card details are entered into and processed by our payment providers. We never see or store your full card number.

When you give us your email for a drop alert, a price alert or the waitlist, we keep the email and what you asked to hear about.

When you make an account, we keep what is listed under Accounts below.

When you arrive at Burger Person, we make a customer card for your device, and when you eat there, we keep a receipt of the visit. See Burger Person below.

When you load a page, we count the visit. See Counting visits.

Who processes it

• Shopify runs the store and holds the order records for every drop. Drop 001 and Cigarettes 2 are paid through Shopify checkout. Shopify also stores the alert and waitlist sign-ups.
• Stripe takes payment for Cigarettes 3, Cigarettes 4 and Burger Person. Its checkout page collects your email, name and card, and for a shirt your shipping address and phone number. It may also ask for billing details that go with the card, such as a country and postal code. For a shirt we then pass your email, name, address, phone number and size to Shopify as a zero dollar order, so the shirt gets made.
• Apliiq prints and ships the shirts. It receives your name, shipping address, phone number if you gave one, and what you ordered, through Shopify. The carrier gets what is on the label.
• Resend delivers our email: sign-in codes, order notes, alerts and drop announcements. It receives your email address and the message.
• Upstash hosts our database: accounts, scores, leaderboards, visit counts, Burger Person receipts, customer cards and counters, and a Cigarettes 4 sales ledger that includes the buyer's email. The ASMR leaderboard is stored by email.
• HubSpot holds the mailing list: your email, the display name you typed on the ASMR board if that is how you joined, the name on your 100 Cigarettes account if you joined through Burger Person, a Burger Person tag if you paid at Burger Person or signed in to your account from there, which alerts you asked for, whether you unsubscribed, and a log of emails delivered to you or bounced, with their subject lines.
• Google is involved only if you choose to sign in with Google. It tells us your email address and name.
• Vercel hosts the sites and runs page analytics on them. It sees standard request data such as your IP address, your browser and the page you asked for.
• Cloudflare runs the Burger Person restaurant, the live room you walk around in. Besides standard request data for that connection, it holds your device id and the name and look you chose while you are in the room and for a short grace after you disconnect, and, if you were sent to pay, your device id next to the id of that Stripe session until the payment lands or a day of the restaurant's own clock has passed. When someone opens a Burger Person visit link, or a link preview fetches one, our Vercel functions pass the IP address of that request to the restaurant. The restaurant keeps a key made from it in memory only, to limit how often one address can ask about visits, and never writes it to storage or logs it. While you are in the room it also holds your customer card's id, the hats it lets you wear, and which menu items your card has seen. For the rest of each clock hour it also keeps, under keys made from your connection's address, a hash of each device id it asked us to make a card for, to limit how many cards one address, or one network, can have made. When your payment is verified, the restaurant is also told how many paid visits your account has made. It does not keep that number. It keeps the id of that Stripe session for the rest of your visit.
• CoinGecko and Coinbase are asked for the price of bitcoin directly from your browser on the Cigarettes 2 page. They see a standard request. We send them nothing about you.

Each of these providers processes data under its own privacy terms.

How we use it

To take payment, print and ship your order, send order and tracking emails, handle exchanges, sign you in, run the leaderboards, seat you at Burger Person, and keep our tax and accounting records. We do not sell your personal information.

The mailing list

Drop announcements go to people who signed up for them and to people who have bought a shirt. Joining the ASMR leaderboard with your email also puts you on the list, and so does paying at Burger Person, or signing in to your 100 Cigarettes account from there; a payment at Burger Person makes an account under the email you gave Stripe if there is none. Making an account on 100cigarettes.com itself does not.

Drop announcements and alerts carry an unsubscribe link. One click and it stops. The emails may record whether they were opened or clicked.

What is public

• The registers show a shirt number, the price paid and the date for shirts sold. On the Cigarettes 2 and Cigarettes 3 registers a name appears only if you chose one and ticked the box. Otherwise the row says Anonymous. On the Drop 001 register a name appears only if someone entered the checkout email for that shirt and typed one.
• The ASMR leaderboard shows the display name you typed and your score. It does not show your email.
• Account handles and scores appear on the leaderboards. See below.
• At Burger Person, the name and look you chose are shown to everyone in the room, a receipt is public at its link, and so is a customer card. See Burger Person.

Accounts on 100cigarettes.com

An account is optional. You never need one to buy a shirt.

If you make one, it holds:

• your email address
• your name, if you give it or if Google does
• the public handle you choose
• your shirt size, only if you give it
• the date it was made
• your game scores
• a record of what you have found and done on the site
• which drops you have bought, matched to the account by the email you verified, and for Cigarettes 3 the box number and the price you paid
• how many paid visits to Burger Person have been credited to it, what they came to, and your customer card there

Your handle and your scores are public on the leaderboards. The leaderboard page shows handles and scores and nothing else. Your Burger Person customer card is public at its link. Nothing else in the account is public. Your email, name, size and orders are shown only to you. Game scores are reported by your own browser.

We sign you in with a one-time code sent to your email, or with Google where that is offered. We never have a password for you. Sign-in requests are rate limited by IP address for an hour and by email address for a day. Those counters expire on their own. The record behind a code holds the email it went to and expires ten minutes after it was sent, or sooner once the code is used.

Your browser keeps a sign-in token in its local storage, not a cookie. If your browser blocks that storage, the sign-in lasts only as long as the tab. A session lasts 90 days from the last time you used it. Sign out ends the session on that browser. Sign out everywhere, on the account page, ends every session on every device at once, this one included.

Your orders list is built by asking the store for orders that carry the exact email you verified. Orders placed under a different email do not appear, and there is no way to claim one by order number. We never ask the store for the shipping address on those orders. The list is not copied into your account: we keep it for ten minutes so the page loads quickly, and we keep one mark per drop saying you bought it. For Cigarettes 3 we also keep the box number and the price you paid, written when your card is charged, so the order shows even before the store lists it.

To delete your account, sign in, open the account page and use Delete account. You need to have signed in within the last 15 minutes, so the page may send a fresh code to your email first, and you type your handle to confirm, or type the word delete if you have no handle. Deleting removes your email, name, size, handle, scores, record, purchase marks and order cache from our database, removes your ASMR leaderboard entries under the same email, and ends every session on every device at once. It cannot be undone. Your handle is held for 30 days, so nobody can pose as you the next morning. After that it is free for anyone, you included. If our database stumbles part way through, the account is already dead and whatever is left is cleared the next time that email signs in. A new account under the same email starts empty.

Deleting your account also deletes your Burger Person customer card: which menu items it saw and when, the counts and their serial numbers, the hats, the lifetime line, the name and look it showed, when it was made, and the hash of the device it belongs to. Its link then answers not found. A Burger Person payment still being credited to your account when you delete stops there: it makes no new account and earns no hats.

Deleting your account does not remove:

• orders and payment records held by Shopify and Stripe, or our own sales ledger of them. If you make a new account with the same email, those orders will appear again.
• your place on the mailing list. The unsubscribe link in a drop announcement or alert does that.
• the delivery logs our email provider keeps of messages already sent.
• the sign-in counters, kept under your IP address for an hour and under your email address, with any plus tag removed (and, for Gmail, any dots), for at most a day, which hold only a count; the record behind a code you asked for in the last ten minutes, which holds your email and expires with it; and a replay guard the ASMR game keeps under your email for 15 minutes.
• Burger Person receipts. They never named your account, so the delete cannot find them. The card link on them then answers not found.
• the link from a device to its card, which holds a one way hash of the device id and the card's random id and expires within a year of the delete. It names nobody.
• a record of each Burger Person payment, kept for 7 days so that it is never counted twice, which holds the random ids of the account and its card, and the serial numbers that payment drew.
• a customer card your device was given before a payment that went on the card your account already had. It is not linked to the account, and it is deleted no later than 400 days after that device's last visit.
• a marker under the account's random id, kept so the dead account cannot be brought back to life. It holds nothing about you. Sign-in tokens on other devices hold only that random id, stop working at once, and are removed when next seen or within 90 days.

Burger Person

Burger Person is a restaurant at burgerperson.com. You do not need an account to eat there. Food is sold there, and one T-shirt.

Your browser keeps a random device id, and the name and look you chose, in its local storage, so the restaurant can put you back in your place if you reconnect. The restaurant holds the same three things while you are in the room and drops them when your visit ends or your grace runs out; see Cloudflare under Who processes it. The name and look are shown to everyone in the room.

The menu runs itself. The lunch special and the items offered for a short time come from a fixed schedule, and nothing about you goes into it. What you can order depends only on when you were in line.

When you first arrive, we make a customer card for your device, before you pay for anything. It keeps which menu items your screen showed you and when, and which items you bought, how many of each and their serial numbers. While you are in the room, the restaurant tells us each menu item it shows you for the first time, and we add it to your card with the time. We find your card by a one way hash of your device id. A card that is not linked to an account is deleted no later than 400 days after that device's last visit.

When a visit ends we keep a receipt: the name and look you chose, the order and its number, the serial number of each item you bought, the times and counts of the visit, the hats it earned, and the id of your customer card if you have one. It holds no email, no device id and no account id, and it is public at its link for a year. Receipts print those serial numbers, and they are public with the receipt. The public counters on the site are totals only: visits, hours waited, walk outs, cuts in line and trays put away. Nobody is named there.

If you pay, Stripe takes the payment and holds the payment record: your email, name, card and any billing details it asked for, plus the visit id and your device id, which tell the restaurant which visit was paid for, and a list of what you ordered. When you go to pay, that tab keeps your visit id and device id in its session storage until the payment is answered or cancelled, or the tab is closed. Once you have paid, your browser keeps the id of that Stripe session in its local storage until the restaurant answers, or until the page finds it more than a day old. Once the restaurant knows your customer card, your browser also keeps the card's id and the hats you have earned in its local storage, so the page can show which hats are yours and link to your card. Paying makes a 100 Cigarettes account under the email you gave Stripe if there is none, and credits that account with the visit and the amount, unless its card belongs to another device. Your first payment links your card to that account. You can see that account, and delete it, on the account page.

An account has one customer card. Every card is public at its link, with an account or without. The card shows when it was made, the name and look from your latest visit, which menu items your screen has shown you and when, which you have eaten, how many of each and their serial numbers, the hats you have earned, and one lifetime line: visits, time in line, people you stepped around, times you were stepped around, times you walked out, trays you put away, and weeks in a row. It shows no email, no device id and no account id.

We link your device to its card when the card is made, so the restaurant knows which hats you may wear and which menu items you have seen. A card belongs to the device it was made for, and to any device you sign in on. A payment from another device with the same email, one you have not signed in on, is still served, but is not credited to that account or its card, and links nothing. We keep a one way hash of the device id, never the id itself: with the card for as long as the card exists, and in a link to the card's id, for 400 days from that device's last visit while the card has no account, and for a year from that device's last visit once it has one. Each time you arrive, the restaurant sends us your device id, we look up the card behind its hash, and the restaurant gets back the card's id, its hats, and which items it has seen and had. If the card belongs to one of our own accounts, the restaurant is told that too, so our own visits stay out of our counts. An arrival can leave a marker under that hash for up to 30 minutes, so that we are told of a visit once and not at every reconnect.

When you open the post sheet, and when you pick a way to post from it, your browser tells us which, along with your device id. We use the id only to check that the restaurant has seen that device, to leave out our own taps and to space out the notifications we get, and we keep a marker under its hash for a minute. What stays after that is a count per day, with nobody in it, and for an hour a count of these requests under your IP address.

You can also sign in to a 100 Cigarettes account from Burger Person, from the receipt or from The Menu, to save your Menu. The game sends you to the account page with a one time code for your device, good for 10 minutes, in the part of the address that is never sent to a server, and the account page sends you back with a yes or a no; neither trip carries your device id, your card's id or your email. Signing in links your device to the account's card: the card keeps a one way hash of your device id in its list of signed in devices, and the device's link points at the card, so the same Menu shows on every phone you sign in on. If the phone had a Menu of its own, it is folded into the account's card, what it saw, what it ate and the serial numbers, the hats and the lifetime line together, and the Menu it had is then deleted. A Menu that belongs to another account stays with that account. While a phone is signed in, a payment from it is credited to that account's card whatever email you give Stripe. Sign out in The Menu takes the phone off the card's list, removes the phone's link and gives the phone a new device id, so it starts a fresh Menu; the account's Menu is untouched. Deleting the account deletes a linked card as it deletes any card, its list of signed in devices with it. Your browser keeps the id of the card you saved to in its local storage, and the one time code in the tab's session storage while you are away signing in.

If you pay at Burger Person, or sign in to your 100 Cigarettes account from there, we copy the account to HubSpot, which holds our mailing list, the same way we copy an ASMR leaderboard entry or a drop alert sign-up: your email, a Burger Person tag, and the name on the account, if it has one and HubSpot did not have your email already. Deleting the account does not remove that copy; the unsubscribe link in any announcement stops the mail.

After your first payment at Burger Person, we send one email to the address you gave Stripe, asking how it went. It is sent once, and it carries the standard unsubscribe header, which mail apps can show as an Unsubscribe button. It may record whether it was opened. A copy of the email we send you, with your address on it, goes to our own mailbox. So that it is sent only once, our database keeps a marker under a one way hash of that address, not under the address itself; deleting your account removes neither that marker nor the copy.

If you buy the T-shirt at Burger Person, Stripe's checkout page also asks for a shipping address, a phone number and your size, and adds a shipping charge. We then pass your email, name, address, phone number and size to Shopify as a zero dollar order, and the printer that makes and ships the shirt takes the order from Shopify; see Shopify and Apliiq under Who processes it. Our own database keeps two things: a note under your customer card's id that the card has bought the shirt, and a record of the order with the ids of the Stripe session and the payment, your size, the time, and how the making of the shirt went, with the store's order number once it is made. Neither holds your name, your email, your phone number or your street address. The receipt of that visit shows the shirt as a line and the shipping charge as a row. Deleting your account removes neither the note nor the order record.

Every customer card has a link to Burger Person that carries the card's id. If you open one in a browser that has no card yet, the browser keeps that id in its local storage until the restaurant has answered your arrival, and sends it to the restaurant with that arrival. When a device that never had a card arrives that way and is given one, we count one new player for the card whose link it was, and keep the count under that card's id. So that a device is counted once, we keep a marker under a one way hash of its device id, which holds nothing else, does not say whose link it was, and has no expiry. To limit how many new players one network can add to a card, the restaurant then makes a key from your connection's address and that card's id and sends us the key, never the address, and we keep a count under it for 30 days. Ten new players earn the card a free soda. We keep how many a card has earned under the card's id, and the id of each Stripe session that used one; the Stripe session of such an order carries the card's id. The restaurant holds whether a free soda is waiting for your card while you are in the room, and beside your device id while you are away paying. Deleting your account removes none of this; none of it holds a name, an email or an account id.

Three days after an account is first seen at Burger Person, by a payment there or by signing in to it from there, we send one email to the account's address, if it has a customer card: an offer of a free soda for bringing ten new players, with the card's link in it. An account that was first seen there before this email existed is sent it as well. This email too is sent once and carries the standard unsubscribe header, and it is not sent to an address that has unsubscribed. It may record whether it was opened and whether its link was clicked. A copy of this one, with your address on it, goes to our own mailbox as well. So that it is sent only once, our database keeps a marker under the account's random id, and until the email has gone, that id in a list with the time it falls due; neither holds your address. Deleting your account removes neither that marker nor that copy, and an account deleted before its email falls due is taken off the list unsent.

Deleting your account deletes the card. Your receipts stay, because they never named your account, and the card link on them then answers not found.

Counting visits

We count page views ourselves, using a random id kept in your browser's local storage. It records the page and where you came from. It is not joined to an account, an email or an order. The games send anonymous play events the same way. Vercel's analytics script also runs on the pages.

One page tells you the city your connection appears to come from. That comes from Vercel's request headers. We do not store it.

Cookies

We set no cookies of our own. The store page loads Shopify's buy button and checkout, which may set cookies necessary for the cart and checkout to function. Stripe's checkout page may set its own.

Your choices

You can ask us for a copy of your data or ask us to delete it, subject to the order records we have to keep for tax and accounting. Accounts can be deleted from the account page without asking anyone. A customer card goes with its account. A Burger Person receipt expires on its own after a year; to have one removed sooner, write to us with its link.

Contact

Email hello@theoriginalcigarettestshirt.com, or reply to your order confirmation.