Privacy Policy

Plain-language version first: we don't sell your data, we don't build a profile of you, and there are no ad networks. The only meaningful thing we store is — with your consent — a random ID that lets the commission from your shopping reach the charity you choose. You can decline or change your mind anytime. Below is the full, accurate detail (GDPR, UK GDPR and CCPA included).

Who we are. ShopToDoGood is operated from Wilmington, Delaware, USA, and is the data controller for the processing described here. Contact: hello@shoptodogood.com.

What we collect, and why

• Affiliate-attribution ID (only with your consent): a random, pseudonymous ID stored in your browser (shoptodogood_user_token). When you click an affiliate link, we tag it with this ID plus the charity you picked, so when the affiliate network reports a sale we can route that commission to your charity. No name, email, or account is attached to it.
• Your charity choice: the charity you select (shoptodogood_charity_code) is stored in your browser so we remember your pick.
• Affiliate click logs (only with your consent): when you click an affiliate link we record the link, the merchant program, your chosen charity, your random ID, a timestamp, and a truncated IP address (the host portion is removed, e.g. 203.0.113.0) for basic fraud/abuse detection. We do not store your full IP in these logs.
• Affiliate networks (e.g. eBay Partner Network): if you complete a purchase, the network reports the sale and commission back to us against your random ID so we can credit your charity. The merchant's own tracking is governed by their privacy policy.
• Optional account (only if you create one): if you choose to make an account, we store your email address and a display name. Sign-in is passwordless — we email you a one-time link and keep a session cookie (stdg_session, httpOnly) so you stay signed in. An account simply lets you see your impact and keep your cause across devices; it links to the same pseudonymous attribution ID above so your dashboard can show what your shopping has raised. You can delete your account and sever that link at any time (see Your rights). Shopping anonymously, with no account, works exactly the same.
• Information you send us: if you use a suggestion, contact, or subscribe form, we store what you submit (including your email, if you provide one) so we can reply or send what you asked for.
• Hosting logs: our host, Cloudflare, processes standard request data (IP, user agent, URL) to deliver and secure the site; these are short-lived.

What we do not do

• No advertising networks, no AdSense, no programmatic ads.
• No third-party analytics currently running (no Google Analytics or similar is active). If we ever enable analytics, it will be gated behind your consent and this page will be updated first.
• No selling or renting of personal information — ever.
• No passwords (optional accounts use a one-time email sign-in link), and no cross-site advertising profiles.
• Calculators run entirely in your browser — their inputs never leave the page.

Cookies & browser storage

We don't use advertising or analytics cookies. We use a small amount of local storage in your browser: your consent choice (shoptodogood_consent), your theme preference, the charity you pick, and — only if you consent — the random attribution ID above. The consent and theme items are strictly necessary and set without asking; the attribution ID and click logging are only ever enabled if you press Accept on the banner. If you create an account, a session cookie (stdg_session, httpOnly, secure) keeps you signed in; signing out or deleting your account ends it.

Manage your privacy choices

Legal bases (GDPR / UK GDPR)

• Consent — for the attribution ID and affiliate click logging. You can withdraw it at any time using the button above (just as easy as giving it), which deletes the ID from your browser.
• Performance of your request — for replying to a form you submit to us.
• Legitimate interests — for keeping the site secure and preventing abuse (using only truncated/short-lived data).

How long we keep it

• Browser storage stays until you clear it or decline — you are always in control and can erase it instantly.
• Attribution and click records are kept while needed to credit charities and reconcile commissions, then periodically purged.
• Account data (email, display name) is kept while your account is active; deleting your account removes it and unlinks you from the attribution records.
• Emails you send are kept until you ask us to delete them or unsubscribe.
• Hosting logs are short-lived (typically days), per our host.

Who processes your data

We use a small number of processors/partners: Cloudflare (hosting, security, and the database that stores attribution/click records) and affiliate networks such as the eBay Partner Network. Processing may occur in the United States; where data of EU/UK residents is transferred, it relies on the providers' standard contractual safeguards.

Your rights

If you are in the EU/UK you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent. Because we never tie the attribution ID to your identity, the fastest way to exercise erasure is to clear your browser storage (or press Decline) — it removes the ID immediately. If you have an account, you can delete it (and unlink your data) instantly from your dashboard. For anything else, email hello@shoptodogood.com and we'll respond within 30 days. You also have the right to complain to your data protection authority (in the UK, the ICO).

California (CCPA/CPRA): we do not sell or share your personal information, and we don't use it for cross-context behavioral advertising. You have the right to know, delete, and opt out; contact us at the address above and we won't discriminate against you for exercising these rights.

Children

This site is not directed to children. We do not knowingly collect data from anyone under 16 (or under 13 in the US). If you believe a child has provided data, contact us and we will delete it.

Changes

If our practices change, we'll update this page and revise the date below. Last updated: 30 June 2026.