Privacy Policy

Last updated: October 9, 2026

Black Altar LLC respects your privacy. This policy explains what we collect, how we use it, who we share it with, and the choices you have when you shop at blackaltar.co.

Who we are

Black Altar LLC
61535 South HWY 97 STE 5-266
Bend, OR 97702
Email: summon@blackaltar.co

Information we collect

When you place an order, create an account, join our email list, take our skin quiz, leave a review, contact us, or browse the site, we may collect:

  • Name, email address, phone number, shipping address, and billing address.
  • Order details, product preferences, and customer service messages.
  • Payment information needed to complete a purchase. Payments are processed by Shopify and its payment partners. We do not store full card numbers.
  • Device, browser, IP address, cookie, and site activity data, such as pages viewed and items added to cart.
  • Marketing preferences, email engagement, and SMS consent where applicable.
  • Your skin quiz answers, like the scents you like, whether you reach for lotion after a shower, and whether your skin runs dry or oily and sensitive or resilient, plus the set the quiz picks for you.
  • The bars you pick in the set builder, and the products you ask us to tell you about when they are back in stock.
  • Reviews you send us, with the name you give and the email you ordered with, so we can match the review to your order.
  • How you found us, like the ad or link that brought you here, the site that sent you, and the first page you landed on.
  • If you apply for wholesale, your shop’s name, type, city, state, website, resale number, phone number, and message.
  • If you send a gift card, the name and email of the person you are sending it to, and your note.
  • If you use our referral program, your referral code and the rewards you earn when friends use it.
  • If you play one of our games, like the garden game, or try our arrival experience, your results and times, and the name you choose for a leaderboard.

How we use information

We use your information to:

  • Process orders, payments, shipping, returns, and customer support.
  • Send order confirmations, delivery updates, account notices, and service messages.
  • Send marketing emails, as explained under Marketing choices below, and marketing texts if you have opted in to them.
  • Show you our ads on other sites and apps, and see which ads and emails lead to visits and orders.
  • Make the site feel like yours, like greeting you by name, showing your last order so you can reorder it, and suggesting bars from your quiz answers.
  • Publish the reviews you send us, with the name you give, once we approve them, and quote approved reviews with that name in our emails and ads.
  • Improve our products, website, customer experience, and fraud prevention.
  • Meet legal, tax, security, and accounting requirements.

Third parties we use

We share information only as needed to run the business, and that includes advertising it. Here is who gets what.

  • Shopify runs our checkout, payments, and customer accounts. It gets what you enter at checkout or in your account, the name and email you give our sign-up forms, the details in a wholesale application, your cart (including a gift card’s recipient and note) and discount codes, the email we fill in for you at checkout, the tracking codes that link your order to your visit for our analytics, ads, and creator partners, and how you first found us, like the ad or link that brought you here, the site that sent you, the first page you landed on, and the date of that first visit. That last part stays on your order for our own records, and we do not send it on to any ad or analytics company.
  • Payment processors and shipping carriers get what they need to take your payment and deliver your order.
  • Klaviyo sends our marketing emails and texts. It gets your email, your name, and your phone number if you gave one, your orders and checkouts, your quiz answers and results, the bars you pick in the set builder, your restock requests, reviews, wholesale details, referral codes and rewards, game and arrival experience results, and how you found us. Once it knows your email, its code on our pages also records the pages you visit, the products you look at, and what you add to your cart, and it records whether you open and click our emails.
  • Meta (Facebook and Instagram) gets the pages you visit, when you scroll halfway down a page or stay on one for a minute, the products you look at, what you add to your cart, sign-ups, and how far you get in our quiz, set builder, and games, along with your IP address, browser details, and Meta’s cookies. If our site has saved your email in your browser, as explained under Ads and your email below, Meta also gets a scrambled (hashed) version of it, so it can match your visit to your Meta account and show you relevant ads. When you sign up in our footer, ask for a restock alert, give us your email in our arrival experience, create an account, or apply for wholesale, our server also sends Meta a scrambled copy of your email, with your IP address, browser details, Meta’s cookies, and the page you were on. From our skin quiz, Meta learns that you started and finished it, not your answers or the set it picked, and if you are new to our list, that you signed up, with the name you typed there, scrambled. Meta gets your checkout steps and purchases from Shopify’s Facebook & Instagram app, which can include scrambled contact details from checkout, depending on its settings.
  • Google runs several tools we use. Google Analytics gets the pages you visit, when you scroll most of the way down a page, when you start or send a form, the products you look at, what you add to your cart, how far you get in our quiz and set builder, and your purchases, along with your IP address, browser details, and Google’s cookies. When you sign up in our footer, ask for a restock alert, give us your email in our arrival experience, create an account, or apply for wholesale, our server also lets Google Analytics know. The copies our server sends to Google Analytics do not include your email. Google Ads gets our purchase numbers and can learn when you add something to your cart, so we can see which Google ads work. Shopify’s Google & YouTube app can also send Google your visit to checkout and your purchase, which can include scrambled contact details from checkout, depending on its settings. Google Maps loads on your account page to suggest addresses, so it gets the address you type there. If you play the video on one of our blog posts, YouTube gets your IP address and browser details and can set its own cookies. Google Workspace runs our email, so messages you send us and some emails our site sends you pass through Google.
  • Pinterest gets the pages you visit, what you add to your cart, and a note each time you send a form on our site (our own code does not pass along what you typed), along with your IP address, browser details, and Pinterest’s cookies. It also gets your purchases, with scrambled contact details from checkout, through Pinterest’s Shopify app.
  • OpenAI (ads in ChatGPT) gets the pages you visit, what you add to your cart, when you start checkout, and sign-ups, along with your IP address, browser details, and its own cookies. For each purchase, our server sends OpenAI a scrambled copy of your email, your IP address and browser details, and what you bought.
  • AppLovin, an ad network that shows ads mostly inside mobile apps, gets the pages you visit, the products you look at, what you add to your cart, when you start checkout, and sign-ups, along with your IP address, browser details, and its own cookie, which our site also keeps a copy of for a year. If our site has saved your email in your browser, AppLovin’s code gets it with each of these, and that code scrambles (hashes) it before sending. Its code also records the links and buttons you click, and it links up with Google’s ad network so the two can recognize the same browser. AppLovin can get your purchases through its Shopify app too.
  • Loop Subscriptions, an app inside Shopify, runs our subscriptions, so it gets your subscription details if you subscribe.
  • Creators we partner with: if you came through a creator’s link or used their code, we note it on your order so they get credit. They see the order number, date, and amount, not your name or contact details.
  • Friends who share a referral code: if you use one, we let them know an order came in so they get their reward. They do not see your name, contact details, or what you bought.
  • Other visitors and Google: when we publish your review, the name you gave, your rating, title, and words show on our site, and we share them with Google so they can show up in Google’s shopping results. We may also quote an approved review, with the name you gave, in our emails and ads. Your email is never shown. If you choose to show your name on a garden game leaderboard, your name and time show there.
  • Adobe Fonts, Cloudflare’s cdnjs, unpkg, WordPress.org, and Shopify’s image servers load some of our fonts, code, and images, so they see your IP address and browser details. Adobe also counts page views for its font license. If you search by zip code on our hot springs page, that zip code goes to Zippopotam.us so the map can find it.
  • GoDaddy hosts our site, and its servers keep logs of visits, including IP addresses and the web address of each page and request, some of which carry your email. Wordfence protects the site and keeps IP addresses and login attempts so it can block attacks.
  • Fraud prevention tools and other service providers that help us run the site get what they need to do that work.

These providers may process information under their own privacy policies. We do not sell your personal information for money.

Ads and your email

We use code from Meta, Google, Pinterest, OpenAI, and AppLovin on our pages so we can see which ads work and show our ads to people who have visited. Our server also sends some of these events to them directly, and Shopify’s apps for Meta, Google, Pinterest, and AppLovin can send them your checkout steps and purchases. Our skin quiz tells them how far you got and whether you signed up, as described above, but not your answers or the set it picked for you. The pages you open after the quiz, like that set’s page, still reach them like any other visit, and the discount code the quiz gives you can ride along in those web addresses and at checkout, with two letters in it that can show the skin type you chose. If your browser sends Global Privacy Control or is set to a European time zone, our pages load none of this code except Google’s, and Google is told not to use your visit for ads, as explained under Cookies and analytics below.

When you give us your email in our sign-up popup or menu, on our links page, in the skin quiz, on our review page, or in the garden game, we save it in your browser so later pages know it is you. We also save it when you open a review or reorder link from our emails, or visit our home page while signed in. From then on, every page you visit hands that email to Meta’s and AppLovin’s code, which turns it into a scrambled code called a hash before sending it. The product views, adds to cart, sign-ups, and garden game events our server sends to Meta carry the same scrambled email, and sign-ups through our footer, restock alerts, the arrival experience, new accounts, and wholesale applications carry a scrambled copy of the email you used there. A hash keeps your email out of plain sight, but it does not hide who you are from these companies, because they make the same code from their own users’ emails to match your visit to your account.

AppLovin’s and OpenAI’s code can also pick up an email address you type into a form on our site, and OpenAI’s can pick up a phone number or name too, and send them scrambled the same way. Depending on its settings, Pinterest’s code can do the same.

To limit how these companies use your information for ads:

  • Your browser: turn on Global Privacy Control, which our site honors, clear cookies and site data for blackaltar.co, which also removes the email we saved, or browse in a private window or with a tracker blocker.
  • Meta: in your Facebook or Instagram settings, open Accounts Center (some accounts now call it Meta Account), then Your information and permissions, then Activity from other businesses, and choose not to let Meta use it, as explained at facebook.com/help.
  • Google: use My Ad Center at myadcenter.google.com, and Google’s Analytics opt-out add-on at tools.google.com/dlpage/gaoptout, which turns off Google Analytics in your browser. Copies our server sends still reach Google Analytics, without your email.
  • Pinterest: go to Settings, then Privacy and data, as explained at help.pinterest.com.
  • ChatGPT: go to Settings, then Ad Controls, as explained at help.openai.com.
  • AppLovin: see Manage Your Privacy Choices in its privacy policy at legal.applovin.com/privacy, or ask it to show you or delete what it has tied to your email at applovin.com/en/privacy-data-request.

You can also email summon@blackaltar.co with any privacy question or request.

Cookies and analytics

Our site uses cookies and similar technologies to keep the cart working, remember preferences, understand site traffic, measure marketing, show you our ads, and improve the shopping experience. They include:

  • Our own cookies, which keep you signed in, remember which creator’s link brought you here (for 30 days), let this browser show your last order for a quick reorder (for up to 180 days), keep our sign-up popup from showing again, help stop spam on the contact form, remember you in the garden game, keep a copy of AppLovin’s cookie (for a year), and, if your browser sends Global Privacy Control or is set to a European time zone, remember that until you close your browser, so our server follows the same rules.
  • Things we save in your browser, like your cart, the email you gave us, your first name for the greeting, your quiz result and set builder picks, any discount code you are using, and how you first found us. The saved email stays until you sign out or clear your browser’s data for our site.
  • Cookies from Meta, Google, Pinterest, Klaviyo, OpenAI, and AppLovin that let them recognize your browser.

You can control cookies through your browser settings. Some parts of the site may not work properly if cookies are disabled. Our site does not respond to Do Not Track signals, but it does honor Global Privacy Control, a setting that Brave and DuckDuckGo send on their own and Firefox sends when you turn it on.

If your browser sends Global Privacy Control, our pages do not load Meta’s, OpenAI’s, AppLovin’s, or Pinterest’s code, and our server does not send Meta, Pinterest, or OpenAI your visits, sign-ups, or quiz results. Google Analytics still runs, but Google is told not to use your visit for ads, both in your browser and in the copies our server sends. Orders you place through our site carry a hidden note saying so, which keeps our server from reporting the purchase to OpenAI and marks our Google Analytics copy of it not for ads. Klaviyo and Shopify work as usual.

If your browser is set to a European time zone, you get the same treatment, without being asked and with no banner. That includes Iceland, the Canary Islands, the Faroe Islands, Madeira, the Azores, Cyprus, Ceuta and Melilla, and France’s overseas regions (Réunion, Mayotte, Guadeloupe, Martinique, French Guiana and Saint-Martin), and we go by your browser’s time zone setting, not by where you are.

Two things are not covered yet. Shopify’s apps for Meta, Google, Pinterest, and AppLovin run inside Shopify’s checkout, which does not see this setting, so they can still send your checkout steps and purchases, depending on Shopify’s own privacy settings, and our garden game pages load Meta’s code for everyone who opens them.

Marketing choices

We add you to our marketing emails when you give us your email through our sign-up forms, the skin quiz, a restock alert, a review, a wholesale application, the garden game, or the arrival experience, when you create an account, and when you choose to get our emails at checkout. If our site already knows your email, the bars you pick in the set builder are saved to your email profile so we can send you your set and a code.

You can unsubscribe from marketing emails using the link in any email. If SMS is available and you opt in, you can opt out by following the instructions in the message. Transactional messages, like order confirmations and shipping updates, may still be sent when needed.

If you have completed our skin quiz, we may occasionally send sponsored or partner content selected based on your quiz responses (for example, products related to your skin traits). These remain emails from Black Altar, and we never share your personal information with the sponsor.

Text messages

If you opt in to text messages at checkout, we will use your phone number to send automated marketing texts, like a reminder about a checkout you started or news about our bars, and transactional texts, like order confirmations and shipping updates. Messages may be sent by autodialer. Consent is not a condition of any purchase.

Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out at any time, reply HELP for help, or email summon@blackaltar.co. After you opt out, you may receive one final message confirming it.

We use Shopify and Klaviyo to send these messages. We never sell your phone number, and mobile opt-in data is never shared with third parties for their own marketing.

CCPA and GDPR rights

Depending on where you live, you may have the right to request access to your personal information, correction, deletion, portability, restriction of processing, or an explanation of how we use it. You may also have the right to opt out of certain sharing or marketing uses.

To make a privacy request, email summon@blackaltar.co. We may need to verify your identity before completing the request.

Data retention

We keep information as long as needed to fulfill orders, provide support, meet legal obligations, prevent fraud, and run the business. When we no longer need it, we delete or de-identify it when reasonable.

Security

We use reasonable safeguards and trusted commerce providers to protect your information. No system is perfect, but we do not treat your privacy casually.

Children

Our site is not intended for children under 13. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. The updated version will be posted on this page with a new date.

Contact

Questions or requests can be sent to summon@blackaltar.co.