Effective October 18, 2026
Privacy and cookies
What Horrorcore Mask Maker stores, which cookies the site uses, and what the site measures. Questions and data requests can be sent from the support form on your account page, or to the reply address on your order confirmation email.
Data we collect to fulfil an order
Checkout is hosted by Stripe. We receive the items, quantities, discounts, order total, and the contact and delivery details you enter there, and we keep an order record (order number, customer name, email, phone, shipping address, purchased items and prices, amounts, production and shipping status, tracking, and - when you were signed in - the account it belongs to) so the order can be produced, shipped, supported, and accounted for.
Private store administration also records order changes and requested tracking emails, including their recipient, content, and delivery attempts, so updates can be checked and duplicate messages prevented. Tracking emails contain the order reference, items, carrier, and tracking details; they do not include your shipping address or phone number.
Card numbers, CVC codes, and banking details are entered on Stripe's own pages and are never sent to or stored on this site.
Accounts
An account is optional; guest checkout is always available. If you create one, your email address and the authentication record are held by Supabase (our database and authentication provider), and your password is never visible to us. Signing in lets you see the orders you placed while signed in. Sign-in sessions are carried in cookies whose names begin with sb-.
Creating an account also asks whether you want occasional promotions email. That choice is stored with your profile as a flag, the date you made it, and where it was made, and only your email address and that flag are used for it. You can change or withdraw it on your account page at any time.
Promotions email
The sign-up form offers occasional email about new masks, new designs, and shop news, and the box is pre-selected. You can clear it before creating the account or change it later on your account page. Declining it never affects account access, order confirmations, or delivery updates, which are sent either way.
The one-time first-order credit, when it is offered, is applied at checkout to a signed-in account that has not ordered before. It is a discount on the order and is entirely separate from the promotions choice - you are never asked to accept marketing email to receive it.
Support messages
The account page carries a support form. Its messages are stored as support tickets in our database and an email notification is sent to our support inbox. Tickets include your account email, message, any related order, status, and private working notes so we can follow up. The notification email carries your account address so we can reply to it directly, together with the order reference you select if you select one.
A ticket is acknowledged only after it has been saved. It remains available to us even if the email notification fails. You can also reply to your order confirmation email instead.
Your cart stays in your browser
The cart is stored in your browser's local storage under horrorcore-cart-v1 and is not sent to us until you start checkout. Clearing your browser data, or completing an order, removes it. No cart contents are stored on our servers.
Analytics runs on every visit
Google Analytics 4 measures the shop for everyone who visits it: page views, catalogue views, which masks are opened, add-to-cart, the start of checkout, and video plays. There is no cookie banner and no on-site opt-out switch - the measurement tag is loaded as soon as a page opens, and the cookies it writes are listed below.
Advertising storage, advertising personalisation and advertising user data are denied, ad identifiers are redacted for Google Analytics. We never send Google your name, email address, phone number, delivery address, or any card detail.
Separately, when an order is paid our server sends Google Analytics 4 one purchase event with the order number, the masks in the order, and the total. That event measures our own sales rather than your browsing, is built from the order record instead of anything typed into a tracking script, and carries no advertising identifiers, so it is never used to advertise to you.
Who processes data for us
Stripe handles payment and card data. Supabase stores accounts and order records. Resend delivers order notification and confirmation email and carries support-form messages. Cloudflare hosts the site and processes requests, including short-lived security and abuse-prevention logs. Google Analytics receives the measurement data described above under Google's own terms of service and privacy policy. The other providers process data on our instruction for these purposes only.
Some product pages embed YouTube videos using youtube-nocookie.com. When a player loads, your browser connects to YouTube; playing a video sends playback information to YouTube under Google's privacy policy.
Blocking measurement in your browser
Google Analytics does not have an on-site opt-out or read Do Not Track or Global Privacy Control. Most browsers can block or clear cookies for this site, a private window discards them when the window closes, and tracker-blocking extensions or Google's own opt-out browser add-on stop the measurement script from running. The shop, the cart, and checkout all keep working when it is blocked.
What we do not do
We do not upload customer contact details to advertising services. Customer order details are shared as needed to take payment, ship an order, provide support, or comply with the law.
Order records and account data are kept while they are needed to provide the order, handle returns and support, and meet accounting obligations. To ask for a copy of your data or its deletion, reply to your order confirmation email. Measurement retention is set in the Google Analytics property itself.
See the Terms of Service and order policy for production, shipping, and refund terms. This page was last revised on October 8, 2026. You can also find Horrorcore Mask Maker on Facebook or Instagram.