Privacy

Last updated October 2026

We collect what we need to make and ship your model, and measure which ads and pages bring people here. We never sell your data.

Who's responsible

The owner of Tiny Town is the person in charge of your personal information here. Write to hello@shoptinytown.com with any question about it.

What we collect

• Your order: the map area, options, plaque text and gift note you choose. Your order page (the link in your receipt) shows its progress; anyone with that link can see the order, so keep it to yourself.
• Tiny Race and Tiny Outdoors: the line of your route, simplified to a few metres. Your GPX file is read in your browser; no times, heart rate or other data from your watch reach us. When you draw a route on the map, the points you tap go to our server so the line can follow the streets. The line goes with your order, to Stripe and our order records, and in the link when you email yourself your design or send it with a message; we use it only to make your model.
• Gift cards: the names and message on the card, and who bought it.
• Checkout details: name, email, phone and shipping address, collected by Stripe. We never see or store your card number.
• Email sign-up: your email address, only if you join the order-by reminder list.
• Design by email: if you ask for your 3D preview by email, your email address, the design, how you found us and your IP address to stop abuse. We send the design once, and add you to the reminder list only if you tick the box.
• Unfinished checkouts: if you agree to emails from us at checkout but don't finish, we email you once with a link back to your order.
• Your approximate city: Cloudflare works it out from your IP address so the map can open near you. We don't store it.
• Messages: your name, email, order number and message, and any photos you add, if you use the contact form or "Message us", with your IP address to stop spam. A message sent from the designer includes a link to the design on your screen. They go to our inbox and a copy is kept with our order records. Your name, email and message may also come to our phone as a text.
• Reviews: the stars, review, name and place you enter on the review form, and your OK to show them on our site. Nothing goes on the site until we've read it.
• Review request: once your model has had time to arrive, we email you once to ask for a review. We don't ask about gifts, or once you've left a review.
• Your orders page: when you sign in, your email address and a one-time code (kept only as a scrambled copy), plus your IP address to stop abuse.
• How you found us: the ad or link you arrived from (campaign tags and ad click IDs in the web address), the pages you view and the options you try. Stored with your order so we know which ads work.

Why we may use it

For visitors in the EU and the UK, the law asks us to say why we may use each piece:

• To make your order and do what you ask: your order, checkout details, gift cards, the design you ask us to email, your orders page and messages about an order.
• Because the law requires it: keeping order records for tax.
• With your consent: Google and Meta cookies, how you found us, the reminder list, the email about an unfinished checkout and the reviews you let us show. You can take it back any time.
• Our legitimate interest: stopping spam and abuse, answering your messages and the one email asking for a review.

Who handles it

• Stripe processes payments.
• Supabase stores our order records, in Canada.
• Resend sends order emails, design emails, reminders, review requests, contact form messages and reviews.
• Twilio sends us a text with your name, email and message when you write to us.
• Cloudflare hosts the site.
• Google (Google Analytics and Google Ads) and Meta (the Meta pixel and Conversions API) measure visits and ad results. When you order, we send them the order value and a scrambled (hashed) copy of your email, phone and address so they can match the sale to the ad you clicked. If you ask for your design by email, Meta gets a scrambled copy of that email address the same way. They can't read the hashed details back.
• Geoapify receives what you type in the place search, through our server, so it doesn't see your IP address. If it's unavailable, your search goes to OpenStreetMap (Nominatim) instead. OpenFreeMap serves the map tiles. Amazon Web Services serves the ground heights for hills. Overture Maps (tiles.overturemaps.org) serves building heights. OpenStreetMap's Overpass servers (overpass-api.de and overpass.kumi.systems) send the map data when our own server can't. FOSSGIS (routing.openstreetmap.de) finds the way along streets and paths when you draw a route on Tiny Race or Tiny Outdoors, through our server, so it doesn't see your IP address. jsDelivr and unpkg serve the code libraries for the 3D preview and the map. Google Fonts serves the fonts. These services see your IP address, like any website you load.

Some of these companies store data outside Canada, including in the United States.

The EU, the UK and Switzerland recognize Canada's privacy law as adequate. When a service stores data in the United States, the transfer relies on the Data Privacy Framework or on standard contractual clauses.

Cookies

Google and Meta set cookies to measure visits and ads. Visitors in Quebec, the EU, the UK and Switzerland are asked first; anyone can change their choice with "Cookie choices" at the bottom of every page. If you decline, we don't send your order to Google or Meta either. "Save for later" keeps your design in your own browser only (so does the route you add on Tiny Race or Tiny Outdoors), and "Message us" keeps your name, email and the messages you sent there too, so the conversation is still there next time. Signing in to "Your orders" sets one cookie of our own that keeps you signed in for 30 days; signing out removes it.

If your browser sends a Global Privacy Control signal, we treat it as a no until you choose otherwise.

What's stored in your browser

Set by Google and Meta, only once you accept where we ask first:

• _ga, _ga_… (Google Analytics): tell visits apart and keep each visit together. 2 years.
• _fbp (Meta): tells visits apart for Meta's ad results. 90 days.
• _fbc (Meta): the Facebook or Instagram ad you clicked. 90 days.

Kept by our own site. They stay until you clear your browser's data for our site, unless a time is given:

• tht_consent: your cookie choice.
• tht_first, tht_last: the first and the latest ad or link you came from. They go with your order.
• tht_sent_…: orders already counted, so reloading an order page doesn't count one twice.
• tht.country, tht.lang: where you ship to and your language.
• th-saved, th-save-sheet: your design from "Save for later", and when we last offered to save it.
• tht-overlay-…: your route or line on Tiny Race, Tiny Outdoors or Tiny Transit.
• tht-cart-…: your order while you're at checkout, until you close the tab.
• th-offer: a free plaque code from our email.
• tht.support: your "Message us" conversation.
• tht_account: a cookie that keeps you signed in to "Your orders". 30 days, or until you sign out.

What we don't do

We don't sell your data or share it with anyone besides the services above.

How long we keep it

• Orders and gift cards: six years after the end of the tax year you bought in, because Canadian tax law requires us to keep business records that long. That includes the name, address and design on each order.
• Sign-in codes for Your orders: a code works once, for 15 minutes. We clear old codes, and the IP address that asked for them, within 30 days.
• The reminder list: until you unsubscribe.
• Everything else: only as long as we need it for the reason we collected it, then we delete it.

Your choices and rights

Every reminder email has an unsubscribe link. To see, correct or delete what we hold about you, email hello@shoptinytown.com. We reply within 30 days. Order records that tax law makes us keep can't be deleted early, but we use them for nothing else.

You can also ask for a copy of your data to take elsewhere, object to how we use it, or ask us to limit it. You can take back your consent any time, with "Cookie choices" at the bottom of every page or the unsubscribe link in our emails.

If you're unhappy

Please tell us first, and we'll try to put it right. You can also complain to a privacy regulator:

• In British Columbia: Office of the Information and Privacy Commissioner for British Columbia
• Anywhere in Canada: Office of the Privacy Commissioner of Canada
• In the UK: Information Commissioner's Office
• In the EU, Norway, Iceland and Liechtenstein: your country's data protection authority
• In Switzerland: Federal Data Protection and Information Commissioner
• Anywhere else: your own country's privacy regulator