What We Know, and What We Do with It.

Packing and shipping your jar, and telling you where it is. Running your subscription and charging the card you gave us on the schedule you picked. Paying creators their cut and sending them the tax forms the law requires.

Sending transactional email: confirmations, shipping, delivery, renewals, failed payments, gift openings. You can't switch those off while you have an active order or subscription, because they're the receipt.

Marketing email and texts only if you opted in — in the footer, at checkout, on the confirmation page, in the chat or from a code card. We record which box you ticked, the words next to it and when. Every marketing email has an unsubscribe link that works on the first tap and supports your mail app's own unsubscribe button; every marketing text takes STOP. Order confirmations, shipping and delivery notes still arrive, because they're the receipt.

If you leave a jar in your bag with your email on it, we may send one or two reminders with a link that puts the bag back. Buying, or unsubscribing, stops them.

Making the builder better. We look at which ingredients get picked together and which mixes get remixed, in aggregate, so the recommendations aren't random.

Stripe processes payments and creator payouts. Supabase hosts the database and handles login. Resend delivers our email and Twilio delivers our texts. Vercel hosts the site. The shipping carrier gets your name and address, because that's how parcels work.

If you came from an ad, the ad network (Google, Meta or TikTok) learns that a purchase happened — or that you joined our list — so we can tell whether the ad worked — a hashed email alongside it where you've let your browser share one. If you've opted into marketing, we may use your hashed email to show you our ads rather than a stranger's and to stop showing you ads for a jar you already bought. Hashed means they can match it to an account they already hold; they can't read it.

Each of those companies only gets what they need to do their job, and each has its own privacy policy that binds them.

We don't sell personal data, we don't rent lists, and we don't hand data to advertisers. If a law or a court makes us disclose something, we'll comply and, where we're allowed to, tell you.

If Crunch Club is ever acquired, your data goes with the store, under these same terms, and you'll hear about it before it happens.

A mix you publish is public: its name, its ingredients, its numbers and the handle that built it. Anyone with the link can see it and remix it. Your email and address are never on a mix page.

Creator pages show the handle, the name and socials you chose, and the mixes you've published. Sales figures on your pages are yours to show or hide from the studio.

A session cookie keeps you logged in. A first-party cookie (rmx_vid) gives your browser an anonymous id for a year, so we can count visits, remember where you came from, and connect the bag you left to the email you gave us. Local storage holds the jar you're building, your cart, your saved mixes if you're not logged in, and whether you like the site in day or night.

When we're running ads, Google, Meta and TikTok pixels load on the store to measure them. Stripe sets its own cookies on the checkout form for fraud prevention. Nothing else follows you around the web.

From your account you can see your orders, change your address, manage every subscription and delete saved mixes. Creators can edit or unpublish anything in the studio.

To get a copy of everything we hold about you, or to have it deleted, email hello@crunchclub.com from the address on the account. We answer within 30 days, usually much sooner. We'll keep the records tax law makes us keep, and nothing else.

If you're in the EU, UK or California you have specific rights to access, correct, delete and port your data, and to object to certain processing. The email above is how you exercise them. We won't treat you differently for asking.

Order records are kept for seven years because tax law says so. Account data stays while the account exists and is deleted within 30 days of you closing it. Server logs roll off after 90 days.

Mixes you've published stay published unless you take them down, because other people's remixes point at them. Removing yours doesn't remove theirs.

If you give us your mobile number and tap the button, we'll text you when your order ships and, now and then, about a drop. Frequency varies and is low — think a few a month at most. Message and data rates may apply.

Reply STOP to any of our texts to stop them all; you'll get one confirmation and nothing after. Reply HELP for help, or email us. Consent to texts is never a condition of buying anything.

We don't share your number with anyone for their marketing. Twilio carries the messages; the carriers aren't liable for delayed or undelivered ones.

The store is for people 16 and over. We don't knowingly collect data from anyone younger. If a kid has made an account, tell us and we'll delete it.

When this page changes in a way that matters, the date at the top changes and account holders get an email. Continuing to use the store after that means you're fine with the new version.

Crunch Club is a brand of JR3 Boxing Ventures LLC, Nashville, TN. hello@crunchclub.com is read by a person.