Privacy Policy
Last updated: October 9, 2026 — DRAFT, please review with legal counsel before relying on it.
The short version
We collect only what we need to run your membership and keep the site working. We don’t sell your data. Stripe handles your payment info — we never see your card. We use a small number of services (hosting, analytics, email delivery) that touch your data in the normal course of running a web app, and we tell you who they are below.
Who we are
The Shed Studio Collective (“we,” “us,” “our”) runs this site at shedstudiocollective.com. We’re based in Williams Bay, Wisconsin. You can reach us at shedstudio45@gmail.com.
What we collect
When you create an account or subscribe
- Your name and email address
- Your subscription status and plan (not your card details — those stay with Stripe)
- Your password (stored as a secure hash — we can’t read it)
When you use the site
- Which videos you’ve watched, how far through, and whether you completed them
- Which sessions you’ve favorited, saved for later, scheduled, or added to your own plan, and which programs you’ve started
- Anything you choose to post in a session’s member conversation (visible to other members)
- Standard web server logs (IP address, browser, pages visited, timestamp) — kept short-term for security and troubleshooting
If you choose to share personal touches
- Your birthday (month and day only — never the year) and a mailing address, if you add them on your dashboard. These are optional and used only so Heather can mail you a handwritten card. You can clear them at any time.
When you contact us
- Your name, email, and whatever you tell us in the message
What we don’t collect
We don’t collect precise location data, biometric data, or anything about you from other apps you use. We don’t fingerprint your device or sell your attention to advertisers.
How we use what we collect
- Run your account — authentication, access to member-only content, your favorites and watch history
- Charge your subscription — via Stripe, which handles your card securely
- Send transactional email — welcome, password resets, renewal receipts, payment-failure alerts, cancellation confirmations
- Make the site better — anonymous or aggregated watch data to understand which sessions resonate
- Keep things secure — detect abuse, prevent fraud, respond to support requests
Who we share data with
We use a small set of trusted services to run the site. Each one gets only the data they need:
- Stripe — processes payments. Gets your name, email, and card details (which only Stripe handles, never us).
- Our hosting provider — stores the site data on secure servers in the United States.
- Email delivery (SendGrid or similar) — delivers transactional emails. Gets your email address and the email content we send to you.
- Analytics (Microsoft Clarity or Google Analytics, if enabled) — may receive anonymized usage data. If we add these, we’ll update this section and offer a cookie choice.
We don’t sell your personal data to anyone. We don’t rent it, share it with advertisers, or let third parties use it for their own purposes.
Cookies and tracking
We use cookies that are necessary to keep you logged in and remember your preferences. We don’t set advertising cookies. If we add any analytics or marketing cookies in the future, we’ll surface a clear choice before using them.
How long we keep your data
- Your account + subscription history: kept while your account is active, and for a reasonable period after cancellation for tax and dispute-resolution purposes.
- Watch history: kept for the life of your account; we’ll prune very old records periodically.
- Contact form messages: kept until resolved, then archived.
- Server logs: kept short-term (usually 30–90 days) for security.
Your rights
You can:
- See what we have about you
- Correct anything that’s wrong
- Delete your account and the data tied to it (we’ll keep whatever we must for legal or tax reasons)
- Export your data in a reasonable format
- Opt out of non-essential email (transactional email related to your subscription will still be sent)
Email shedstudio45@gmail.com and we’ll handle it personally within a reasonable time.
If you live in a jurisdiction with specific data-protection rights (GDPR, CCPA, etc.), those rights apply to you — email us and we’ll walk through them.
How we protect your data
Passwords are stored as salted hashes. Payment data lives only at Stripe, which is PCI-DSS Level 1 certified. All site traffic uses HTTPS. We maintain reasonable technical and organizational safeguards appropriate to a small studio of our size.
No system is perfectly secure. If a breach ever affects you, we’ll notify you as required by law.
Children’s privacy
The site is intended for adults. We don’t knowingly collect data from anyone under 18. If you believe a child has given us data, email us and we’ll delete it.
Changes to this policy
If we update this policy, we’ll change the date at the top. Material changes get a note on the site or an email to active members.
Questions
Any questions about this policy or your data, email shedstudio45@gmail.com. We read everything.