Privacy policy
Last updated 30 October 2026
We take your privacy seriously. This explains what we collect, who we share it with, and what you can tell us to stop doing. We sell only within the United States, so this is written around US privacy law.
What we collect
- Order information — your name, email address, delivery address and, if you give it, your phone number.
- Payment information — handled entirely by Square. Card details are entered into fields hosted by Square and never reach our servers.
- Resale exemption details — if you tell us an order is for resale, we record that and your New York Certificate of Authority number, because we are required to keep it on file.
- Technical data — the IP address a request came from, kept in server logs.
- Usage data — which pages you visit, roughly where in the world you are, and what kind of device and browser you use, collected through Google Analytics. This is not tied to your name or email address.
What we do with it
- Take payment, pick your order and get it to you
- Answer your questions and provide support
- Meet our tax record-keeping obligations
- Detect and prevent fraud
- Email you about new candy and deals, only if you tick the box at checkout. Every one of those emails has a one-click unsubscribe link.
- If you enter your email at checkout but don't finish your order, send one reminder about the items in your basket a few hours later. It has a link to stop basket reminders, and it never adds you to our mailing list.
Cookies and tracking
We use Google Analytics to understand how people find and use this site — which pages get visited, which products get looked at, and where visitors arrive from.
We also use Google Ads. Its tag tells us when one of our ads led to an order, and lets us show our ads again on other sites to people who have visited this one (called remarketing). Google receives the pages you view and, when you order, the order number and total, never your name, email or address.
We also use the Meta (Facebook & Instagram) pixel. It tells us when an ad
on Facebook or Instagram led to an order, and lets us show our ads there to people who have
visited this site. Meta receives the pages you view and, when you order, the order total,
never your name, email or address. It sets the _fbp cookie.
We also advertise on Microsoft Advertising (Bing). Its tag works the same way: it tells us when one of our ads led to an order, and lets us show our ads to people who have visited this site. Microsoft receives the pages you view and, when you order, the order number and total, never your name, email or address.
If your browser sends a Global Privacy Control or Do Not Track signal, none of these tags loads at all. You can also turn off personalised ads from Google at adssettings.google.com and from Microsoft at account.microsoft.com/privacy/ad-settings.
These are the cookies involved:
cw_session— keeps your basket between pages. Set by us, expires when you close your browser._gaand_ga_*— set by Google Analytics to tell one visit from another. They do not carry your name or email._gcl_auand Google's advertising cookies — set by Google Ads to connect an ad click to an order and to build remarketing lists._uetsid,_uetvidandMUID— set by Microsoft Advertising for the same purpose.- Square sets its own cookies on the checkout page to process your payment securely and detect fraud.
You can refuse cookies in your browser settings, and Google publishes a browser add-on that opts you out of Google Analytics everywhere. The session cookie above is the one the site needs, so refusing that one mainly means your basket will not survive between pages.
Who we share it with
We do not sell your personal information. We share it only with:
- Square — to take your payment and record the sale against our inventory
- Shipping carriers — USPS and other carriers, to deliver the parcel
- Google — usage data through Google Analytics, and through Google Ads the pages you visit and your order number and total, to measure and target our ads. Your name, email and address are never sent there.
- Meta — through the Meta pixel, the pages you visit and your order total, to measure and target our ads on Facebook and Instagram
- Microsoft — through Microsoft Advertising, the pages you visit and your order number and total, to measure and target our ads. Your name, email and address are never sent there.
- Government authorities — where the law requires it, including sales tax records
How long we keep it
Order records are kept for as long as tax and accounting rules require. Resale certificates are kept while they are relied on and for the record-keeping period afterwards. Server logs are kept briefly and then discarded.
Your choices
You can ask us what we hold about you, ask us to correct it, or ask us to delete it — email support@sweetcitycandy.com and we will respond. We cannot delete records we are legally required to keep, such as completed order and tax records, and we will tell you if that applies.
Children
This site is not directed at children and we do not knowingly collect information from anyone under 13.
Changes
If this policy changes we will update the date at the top. Material changes will be obvious rather than quiet.