Privacy policy
Fat and Weird Cookie Co.
Last updated: October 25, 2026
1. Overview
Fat and Weird Cookie Co. ("Fat & Weird," "we," "us") runs fatandweirdcookie.com (the "Site"). This policy explains what personal information we collect when you visit the Site, buy from us or talk to us, how we use it, who we give it to, and the choices and rights you have. If you have questions, email privacy@fatandweirdcookie.com.
2. Personal information we collect
We collect these categories of personal information:
- Personal identifiers: name, email address, postal address, phone number and online identifiers (such as cookie IDs and device IDs).
- Internet activity: how you use the Site, such as pages viewed and items added to your cart.
- Commercial information: what you buy from us.
- Financial information: credit or debit card number. Cards are processed by our payment processors; we do not store full card numbers ourselves.
- Location information: general location, such as city or region from your IP address.
- Inferences: conclusions drawn from the other information, such as products you might like.
We do not use sensitive personal information (such as precise location, health or financial account log-ins) to infer things about you.
3. Cookies and similar tools
We use cookies so the Site works well for you. For example, they keep you logged in and remember what is in your cart. We also allow third-party cookies and pixels for advertising and analytics. These let third parties collect information about your activity on our Site over time and across other websites. Some of our analytics tools (Microsoft Clarity and Contentsquare) record how visitors use our pages, such as clicks, scrolling and mouse movement, so we can find and fix problems with the Site. Microsoft Clarity records our checkout pages through the Microsoft Clarity app for Shopify. It may also record our other pages, but only for visitors who have not opted out and whose browser does not send Global Privacy Control. Microsoft collects or receives personal information through Clarity to provide Microsoft Advertising. Microsoft is not our service provider for Clarity and may use this information for its own purposes, including improving its services and building advertising profiles. See the Microsoft Privacy Statement at https://privacy.microsoft.com/en-us/privacystatement. You can block or delete cookies in your browser settings. Section 7 explains your opt-out choices, including the current limit for Clarity.
Do Not Track. Some browsers send a "Do Not Track" signal. There is no common standard for it, so we do not respond to it. We do honor Global Privacy Control (section 8).
4. Where we get personal information
- From you, when you place an order, create an account, sign up for emails or texts, write a review, answer a survey or contact customer service.
- Automatically, from your device and browser when you use the Site (cookies and pixels).
- From our service providers, such as Shopify and our payment processors, when they help us run the Site and fill orders.
5. How we use your personal information
We use personal information to:
- analyze data
- conduct surveys
- create customer profiles
- deliver targeted ads
- fill customer orders
- improve our products and services
- run internal business operations
- market our products and services
- meet compliance and legal requirements
- operate our website and apps
- prevent fraud
- process payments
- provide customer support
- send promotional emails and texts
- store and manage data
- track purchases and customer data
We do not collect, use or sell personal data to train large language models.
6. How we disclose your personal information
We disclose personal information to service providers (who work for us under contract) and to third parties, as follows:
| Category | Service providers | Third parties |
|---|---|---|
| Personal identifiers | Business operations tools, collaboration and productivity tools, commerce software, contractors, customer support tools, governance, risk and compliance software, payment processors, sales and marketing tools | Ad networks, data analytics providers, a data cooperative, sales and marketing tools |
| Internet activity | Commerce software, contractors, payment processors, sales and marketing tools | Ad networks, data analytics providers, a data cooperative, sales and marketing tools |
| Commercial information | Business operations tools, commerce software, payment processors, sales and marketing tools | Ad networks, data analytics providers, a data cooperative, payment processors |
| Financial information | Business operations tools, commerce software, payment processors, sales and marketing tools | Payment processors |
| Location information | Sales and marketing tools | Data analytics providers (Microsoft Clarity works out general location from the IP address it receives) |
| Inferences | Contractors | Ad networks, data analytics providers, sales and marketing tools |
Third parties we have disclosed, or may disclose, personal data to:
- GoAffPro Affiliate Marketing
- Google Ads
- Google Analytics
- Meta Ads
- PayPal (Pay with PayPal, Venmo, Pay Later)
- Pinterest Ads
- Shopify Network Intelligence
- Triple Whale
- TikTok Ads
- Microsoft (Clarity), which may also use this data for its own purposes, including advertising
- Contentsquare
- Klaviyo (sends our emails and texts for us as a service provider)
We may also disclose information when the law requires it, to protect our rights, or as part of a merger, sale or similar business transfer.
Shopify. Our store runs on Shopify, which processes personal information to provide its services to us. Shopify's own privacy policy is at https://www.shopify.com/legal/privacy.
Links to other sites. The Site may link to other websites. Their privacy practices are their own, and this policy does not cover them.
7. Selling, sharing and targeted ads
Some state laws call it "selling" or "sharing" when a business lets ad and analytics partners collect data through pixels and cookies, even when no money is paid. Under those definitions:
- We "share" personal identifiers, internet activity, commercial information and inferences with ad networks for cross-context behavioral advertising, so the ads you see are more relevant.
- We "sell" personal identifiers, internet activity, commercial information and inferences to third parties. In Connecticut and Rhode Island the specific third parties we have sold personal data to are Google Analytics, Microsoft (Clarity), Shopify Network Intelligence and Triple Whale.
- We process personal data for targeted advertising (personal identifiers, internet activity, commercial information and inferences).
- We do not sell sensitive personal data.
- Apart from the Clarity limit below, we do not sell or share the personal information of anyone we know, or should reasonably know, is under 18, or use it for targeted ads. We do not ask for or collect date of birth, and the Site is not directed at children. If we learn that a customer is under 18, we apply the opt-out to that account and remove it from any advertising audience. These steps do not stop Clarity checkout recordings in our current setup (see "Microsoft Clarity and opt-outs" below). The Clarity limit also applies to these younger customers.
How to opt out: use the Your Privacy Choices link at the bottom of every page (https://www.fatandweirdcookie.com/pages/data-sharing-opt-out), turn on Global Privacy Control (section 8), or email privacy@fatandweirdcookie.com with "Opt out" in the subject. You do not need to verify your identity to opt out. We may refuse an opt-out request only if we have a good-faith, reasonable and documented belief that it is fraudulent.
Microsoft Clarity and opt-outs. We treat Microsoft as a third party for Clarity. Our current setup does not stop Clarity from recording your checkout when you opt out with the Your Privacy Choices link or by email; we found no setting in the Microsoft Clarity app for Shopify that turns it off for those opt-outs. In our tests, when the browser sent Global Privacy Control, no Clarity recording data was sent from our checkout pages, but the browser still made a request to load Clarity's settings, which shows Microsoft your IP address and the page you are on. You can turn on Global Privacy Control before you check out (section 8), but our tests were limited and we cannot promise the same result for every checkout.
8. Global Privacy Control
If your browser sends a Global Privacy Control (GPC) signal, our store treats it as a request to opt out of sale, sharing and targeted advertising for that browser. In our checkout tests, GPC stopped Clarity recordings, though Microsoft still received the settings request described in section 7. A GPC signal applies to the browser that sends it. To apply your opt-out to your account and email address too, email us at privacy@fatandweirdcookie.com with "Opt out" in the subject. An opt-out sent by email does not stop Clarity checkout recordings in our current setup. GPC is available in some browsers and as a browser extension; see https://globalprivacycontrol.org.
9. How long we keep your information
We keep personal information only as long as we need it for the purposes in this policy. In general:
| Information | How long we keep it |
|---|---|
| Cookies and online data from using the Site (online identifiers, internet activity, general location) | As long as needed for analytics and advertising measurement. Each tool keeps it for its own set period (for example, Google Analytics is set to its standard retention period) |
| Order data (name, email, postal address, phone, purchases, last four digits and type of card, general location) | As long as needed to fill your order, and then as long as we need it for tax, accounting, fraud prevention and legal reasons |
| Customer service messages and inquiries (same fields as order data) | As long as needed to help you and to keep a record of what we told you, or until you ask us to delete them |
| Email and text marketing data (name, email, postal address, phone, online identifiers, internet activity, general location, inferences) | Until you ask us to delete it. If you unsubscribe, we stop messaging you but keep your marketing profile (contact details, past messages and site activity) in a suppressed state so we do not message you again. If you ask us to delete it and you had opted out or unsubscribed, we keep only your email or phone number and that choice, so we can keep honoring it if you shop with us again |
| Reviews, surveys and feedback (name, email, postal address, phone, purchases, general location) | As long as the review or feedback is useful to us or shown on the Site, or until you ask us to delete it |
| Privacy request records (name, email, online identifiers) | As long as the law requires, and at least 24 months |
| Security data (name, email, online identifiers) | As long as the law requires and as needed to keep our systems secure |
If we hold deidentified information, we will not try to reidentify it.
Security. We use reasonable safeguards to protect personal information, but no system is completely secure.
10. Children
The Site is not meant for children. We do not knowingly collect personal information from children under 13. We do not sell or share the personal information of anyone we know, or should reasonably know, is under 18, or use it for targeted ads, apart from the Clarity limit in section 7.
11. Your privacy rights
Depending on the state you live in, you may have the right to:
- Know and access: confirm whether we process your personal information and get a copy, in a portable format where processing is automated.
- Delete: ask us to delete personal information we have about you. We will delete it and tell our service providers, contractors and third parties to do the same, except where the law lets us keep it. Anything we keep for those reasons is not used for anything else.
- Correct: fix inaccurate information, taking into account what the information is and why we use it.
- Opt out of sale, sharing, targeted advertising and profiling. Section 7 explains how, and the current limit for Clarity. We do not profile people to make decisions with legal or similarly significant effects, such as decisions about loans, jobs or insurance.
- Get a list of third parties we have disclosed or sold your data to (see sections 6 and 7; Connecticut, Minnesota, Oregon and Delaware residents).
- Withdraw consent where we rely on consent (Kentucky and others).
- Limit use of sensitive personal information: this right does not apply because we do not use sensitive personal information to infer things about you.
- Not be discriminated against for using these rights. We will not charge you a different price or give you a different level of service, and we will not retaliate against an employee, job applicant or contractor for using these rights.
How to make a request: email privacy@fatandweirdcookie.com. Tell us what you want (access, delete, correct, opt out, third-party list, withdraw consent or appeal) and the state you live in. We will reply within 45 days. If we need more time, we will tell you why, and we may extend by up to 45 more days where the law allows.
Fees: requests are free. If you ask for access more than twice in 12 months (more than once for Oregon residents), or a request is clearly unfounded or excessive, we may charge a small fee.
How we verify: before we act on an access, deletion or correction request, we confirm you are the person the information is about, usually by checking that you control the email address we have on file. If we cannot verify you with reasonable effort, we may ask for more information or deny the request. Opt-out requests do not need verification.
Authorized agents: someone you authorize can make a request for you by emailing privacy@fatandweirdcookie.com. We will still verify your identity and ask you to confirm that you gave the agent permission, unless the agent has a power of attorney under California Probate Code sections 4121 to 4130. You may also authorize an agent to opt out for you through a technology such as a browser setting or global device setting (for example GPC), if we can confirm the agent's authority.
Appeals: if we decline your request, you can appeal within 90 days of our decision by emailing privacy@fatandweirdcookie.com with "Appeal" in the subject. We will answer your appeal in writing within 60 days and explain our reasons. If we deny your appeal, we will also tell you how to contact your state Attorney General.
12. State notices
| State | What applies |
|---|---|
| California (CCPA) | We "share" and "sell" as described in section 7. All rights in section 11, including opt-out of sale and sharing. Complaints: California Attorney General or California Privacy Protection Agency. |
| Colorado (CPA) | We "sell" and run targeted ads. Rights: access and portability, delete, correct, opt out, appeal. Complaints: Colorado Attorney General. |
| Connecticut (CTDPA) | We "sell" (to Google Analytics, Microsoft (Clarity), Shopify Network Intelligence and Triple Whale) and run targeted ads. Rights: access and portability, delete, correct, opt out, profiling rights, a list of the third parties we sold your data to, appeal. Apart from the Clarity limit in section 7, we do not sell, or use for targeted ads, the data of consumers we know or should reasonably know are under 18. Complaints: Connecticut Attorney General. |
| Delaware (DPDPA) | We "sell" and run targeted ads. Rights include a list of the categories of third parties we disclose data to (section 6). Complaints: Delaware Attorney General. |
| Florida (FDBR) | The FDBR generally does not apply to us. We do not sell sensitive personal data. |
| Indiana (INCDPA) | We do not receive money for data, so we do not "sell" under the INCDPA. We run targeted ads; you can opt out. |
| Iowa (ICDPA) | We do not receive money for data, so we do not "sell" under the ICDPA. We run targeted ads; you can opt out. We do not process sensitive data. |
| Kentucky (KYCDPA) | We do not receive money for data, so we do not "sell" under the KYCDPA. We run targeted ads; you can opt out and withdraw consent. |
| Maryland (MODPA) | We "sell" and run targeted ads. |
| Minnesota (MNCDPA) | We "sell"; targeted ads use online identifiers and internet activity. You may get the list of specific third parties in section 6 and use profiling rights. |
| Montana (MCDPA) | We "sell" and run targeted ads. |
| Nebraska (NDPA) | We "sell" and run targeted ads. |
| Nevada (NRS 603A) | You can review, delete and correct covered information collected online. We do not sell covered information for money. Third parties collect information about your online activity over time and across sites through cookies (section 3). |
| New Hampshire (NHPA) | We "sell" and run targeted ads. |
| New Jersey (NJDPA) | We "sell" and run targeted ads. |
| Oregon (OCPA) | We "sell" and run targeted ads. Apart from the Clarity limit in section 7, we do not sell or use for targeted ads the data of residents under 16. You may get the list of specific third parties in section 6. Access fee may apply after one request in 12 months. |
| Rhode Island (RIDTPPA) | We "sell" (to Google Analytics, Microsoft (Clarity), Shopify Network Intelligence and Triple Whale) and run targeted ads. |
| Tennessee (TIPA) | We "sell" and run targeted ads. |
| Texas (TDPSA) | We "sell" and run targeted ads. You may opt out of profiling (we do not profile for significant decisions). |
| Utah (UCPA) | We do not receive money for data, so we do not "sell" under the UCPA. We run targeted ads; you can opt out. |
| Virginia (VCDPA) | We do not receive money for data, so we do not "sell" under the VCDPA. We run targeted ads; you can opt out. Complaints: Virginia Attorney General. |
The rights in section 11 apply in each state above as that state's law provides. Every state: appeal within 90 days of our decision.
13. Complaints
If you have a concern, email us first at privacy@fatandweirdcookie.com and we will try to fix it. If you believe your rights were violated and we cannot resolve it, you can complain to your state Attorney General (or, in California, the California Privacy Protection Agency).
14. International users
We sell in the United States. If you visit from outside the US, your information is processed in the US.
15. Changes to this policy
We may update this policy. We will post the new version here with a new "Last updated" date. If changes are significant, we will tell you in a clear way, such as a notice on the Site.
16. Contact
If you have questions about this policy or need it in another format, email privacy@fatandweirdcookie.com or write to Fat and Weird Cookie Co., 2540 Jenks Ave, Panama City, FL 32405.
Our accessibility policy and practices are at https://www.fatandweirdcookie.com/pages/accessibility.
