$ cat /etc/privacy.conf
# look, we just want to send you coffee.
# we collect the bare minimum to do that.
# no trackers. no ad pixels. no data brokers.
# your data isn't the product. the coffee is.
last updated: october 19, 2026
operator brewing co. ("we", "us") takes your privacy seriously. we're security people — we know what bad data practices look like, and we want no part of it. this policy explains exactly what we collect, why, where it lives, and how to get it deleted.
// THE SHORT VERSION
>shopify holds who you are: name, email, addresses, orders, payments. it is built for that and audited for it.
>our ledger (Cloudflare D1) holds the game: your handle, points, rank, perks, and your login security material. it is keyed by an opaque customer id. it does not hold your name, email, address, or card.
>nobody else gets a copy of your purchase history. the third parties below each get only what their one job needs.
// WHAT WE COLLECT
to make your account and send you coffee (stored in shopify):
>email + name — login, order confirmations, shipping updates
>shipping address — so the coffee arrives at your door, not ours
>order history — receipts, subscriptions, and the spend that drives your rank
>payment info — handled entirely by shopify's checkout. we never see your card number.
to run the loyalty system (stored in our ledger):
>handle — your public display name (3–32 chars, you pick it). the only human-readable identifier in the ledger.
>points, rank, rank history — one point per dollar, plus event bonuses. every credit and debit is logged so we can show our work.
>flags — service status (military, veteran, first responder or government employee, verified via GovX), active subscriber, birthday month. these unlock the matching discounts and the birthday bag.
>notification preferences — which emails you want (orders, drops, subs)
>referral code — a short token derived from a one-way hash of your customer id. it is not your handle and cannot be reversed into it. conversions record which account referred which, by id only.
>roast votes and perk fulfillment — what you voted for, and which perks (birthday bag codes) have been issued, by month
>certification boost — the extra-points percentage your verified certs add to orders
>a mirror of rank, points and flags is also written to your shopify customer record so checkout can apply the right discount. same data, second location.
if you verify certifications:
>cert name + provider — which cert was verified, for your points and cert boost
>a hash of the verification — prevents the same credential being claimed on two accounts
>NOT stored: your HTB API token, your Credly or Accredible email, badge details — used once during verification and immediately discarded
if you enable MFA:
>TOTP secret — AES-256-GCM encrypted at rest
>passkey public keys — for WebAuthn authentication
>recovery code hashes — salted SHA-256 (never plaintext)
if you leave a review:
>name, email, rating, text, photos — sent to Judge.me, who host reviews for us. photos are parked briefly in our storage while Judge.me fetches them, then removed.
>when a review is approved, Judge.me tells us the reviewer's email so we can credit review points to the matching account. we look the account up in shopify and keep only the point event.
// WHAT WE DON'T COLLECT
>no invasive analytics or tracking pixels (no Google Analytics, no Facebook Pixel)
>no third-party ad scripts or retargeting
>no fingerprinting, no behavioral tracking
>no selling or sharing data with data brokers — ever
>no CRM or marketing automation platforms
>no raw IP addresses in our database. rate limiting keys on a one-way hash of the address, which is discarded when the window closes.
>no payment info. shopify handles all payment processing (PCI-DSS compliant).
// COOKIES
we set four cookies on operatorbrewing.co. three keep the site working. the fourth, obc_campaign, only remembers which of our own campaign links you arrived on, so we can tell which posts lead to orders. none are for advertising, and none are shared with ad networks.
KEY
PURPOSE
LIFETIME
obc_session
keeps you logged in (HttpOnly, Secure, SameSite=Strict)
10 hours
obc_logged_in
ui flag so the site knows to show your account
10 hours
obc_mfa_pending
temporary MFA verification state (HttpOnly)
5 minutes
obc_campaign
the campaign tag of our link you arrived on (for example, which instagram post), set only when the link carried one of our tags. holds that tag and nothing else (HttpOnly, Secure, SameSite=Lax)
7 days
the checkout page is hosted by shopify and sets shopify's own cookies once you are there. those are covered by shopify's cookie policy.
browser storage (never leaves your device):
KEY
PURPOSE
LIFETIME
obc_cart
your cart contents, so they survive a refresh
until you clear it
obc_cookie_ok
that you dismissed the cookie notice
until you clear it
obc_ref
the referral code from a link or QR code you arrived on, so you get 10% off a first order and the referrer gets credit
30 days
obc_checkout_cart
the cart you just sent to checkout, so we can restore it if you come back
this tab
obc_bday_code
a birthday bag code waiting to be applied at checkout
this tab
obc_drops_unlocked
that you entered a drops access code
this tab
obc_sub_nudge
that you dismissed the subscription hint in the cart
this tab
// WHERE YOUR DATA LIVES
>shopify — your email, name, addresses, order history, subscriptions, payment info, and a mirror of your rank and flags. shopify is PCI-DSS compliant and handles all payment processing. data stored in shopify is subject to
shopify's privacy policy.
>cloudflare D1 — the loyalty ledger and your MFA credentials, keyed by customer id. encrypted at rest on cloudflare's network.
>campaign records (also in D1) — for each paid order: the campaign tag it arrived with (or none), the amount, discounts and refunds, keyed by shopify's order number. no name, email, address or customer id. kept for 400 days, and erased with the order when you ask us to delete your data. we also keep a daily count of visits that arrived on each campaign link: a number per day, nothing about who.
>cloudflare R2 — review photos, temporarily, until Judge.me has fetched them.
>cloudflare turnstile — bot detection on login, register, review and upload forms. no data stored — just a pass/fail check.
// THIRD PARTIES
we share data with these services, each for one job:
>shopify — e-commerce platform (orders, payments, customer records, checkout) —
their privacy policy >cloudflare — hosting, database, storage, CDN, bot protection, and cookie-free web analytics (see below)
>plausible analytics — privacy-friendly traffic stats (see below) —
their data policy >judge.me — hosts product reviews. receives what you type into the review form. —
their privacy policy >printful and
customcat — print and ship merch. shopify passes them your name and shipping address for merch orders only, plus the text you asked to have embroidered (your handle) so it can be stitched. —
printful's privacy policy,
customcat's privacy policy >govx — verifies military, veteran, first-responder and government-employee status for the 10% service discount. you verify on their site; we receive only a yes and a discount code, never your service records.
>credly / accredible / hack the box — only when YOU initiate a cert verification. we send the minimum needed to confirm your cert, then discard it.
>script CDNs (unpkg, jsDelivr) — serve the site's open-source libraries, pinned by integrity hash. like any web host, they see your IP address for that request.
that's it. no ad networks. no data brokers. no "partners" getting a copy of your purchase history.
// ANALYTICS
we use plausible analytics to understand general traffic patterns — which pages are visited, where visitors come from, what devices are used. plausible is a privacy-friendly alternative to google analytics:
>no cookies — plausible does not set any cookies in your browser
>no personal data — no IP addresses, no fingerprinting, no user profiles
>no cross-site tracking — your visit here is not linked to anything else
>all data is aggregated — we see trends, not individuals
>EU-owned and GDPR compliant by design
plausible receives our events through our own server, never straight from your browser: the public page you are on (never account, login or reset pages, and never the rest of the address), the site you came from, the campaign tag of the link you arrived on (only our own tags, and only with the first page), and two events: an item added to the cart and a checkout started. our server passes your IP address and browser name to plausible so it can count unique visitors without cookies; plausible turns them into an anonymous count that changes daily and discards them. we never store them. no item, no amount, no identifier.
we also use cloudflare web analytics, built into our hosting. it sets no cookies and builds no profile; it reports page loads, the site you came from, country and device type, in aggregate.
if your browser sends global privacy control or do not track, nothing is sent to plausible. the campaign tag still goes on your order: it is our own first-party label, used only for our reports, never sold or shared.
// CHECKOUT
browsing and your cart happen on our infrastructure — no shopify scripts run in your browser while you shop. when you check out, we hand your cart to shopify and you complete the order on a shopify-hosted checkout page. shopify receives:
>your cart contents (products, quantities, subscription cadence) and the options you chose on each line: size, design, the rank printed on a sleeve, the handle to embroider
>your account identity (so checkout can prefill your details and apply your rank, service and subscription discounts, which live as flags on your shopify customer record rather than as codes)
>a birthday bag code or a referral code, when you have one
>the campaign tag of the link you arrived on, when there was one (from the obc_campaign cookie). it is a label for our reports and never changes your price
>your name, email, shipping address, and payment info to complete the order
we never see your card number. data stored in shopify is subject to shopify's privacy policy.
// YOUR RIGHTS
if it's not on your account page, we don't have it. everything in the ledger about you is visible right there — no hidden profiles, no shadow data.
>access — your account page shows everything we know about you. for a full export, email us; we pull your shopify record and the ledger together.
>correction — edit your handle, name, address, and preferences in account settings
>deletion — email us. we delete your shopify customer record, and shopify's erasure signal automatically wipes every row about you from our ledger — points, rank, certs, referrals, MFA, all of it. no manual step, nothing left behind.
>marketing opt-out — toggle in account settings, or unsubscribe from any email
// SECURITY
>all traffic is encrypted with TLS 1.2+
>session cookies are HttpOnly, Secure, and SameSite=Strict with a 10-hour expiry
>sessions are revoked server-side on logout — tokens are invalidated, not just cleared
>MFA secrets are AES-256-GCM encrypted at rest with HKDF-derived keys
>recovery codes are salted + hashed (never stored in plaintext)
>rate limiting on login, registration, MFA, drops codes and cert verification — per account and per hashed IP
>every message shopify sends us (orders, refunds, erasure requests) is signature-verified before we read it
>your discounts are tied to your account, not to a code. a birthday or referral code copied off a receipt does nothing for anyone else.
>every price rule runs at checkout on shopify's side, not in your browser. nothing you change on the page can change what you are charged.
>we don't store verification artifacts — emails, API tokens, and badge data are used once and discarded
// CONTACT
questions about your data? something feel wrong? let us know.
// tl;dr: shopify keeps your identity. we keep your score.
// we encrypt the important stuff, we don't track you, and we don't sell your data.
// if you want out, email us and the whole trail gets nuked, both sides.
// drink responsibly. pwn responsibly. store data minimally.