Privacy policy

Effective October 10, 2026

This policy explains what personal information luh calm(“we”, “us”), operated by Luh Labs LLC, collects through luhcalm.fit, how we use it, and the choices you have. We collect as little as we can to run the shop.

What we collect

When you join the waitlist

Your email address, the time you signed up, and the consent statement you agreed to.
If you choose to give them: the pants you're interested in and your waist size, which we use to decide how many of each size to make.
If you add a phone number: the number, plus the text-message consent you agreed to and when. Giving a number is optional, and we only text people who ticked that box.

When you place an order

Your name, email, shipping address, what you ordered, and payment status. Checkout is run by Stripe: you enter your card details on Stripe's page and we never receive your full card number.

When you contact us or send a privacy request

Your email address and whatever you choose to tell us.

Automatically

Our host keeps standard server logs (IP address, browser type, pages requested, time) to deliver and protect the site.
A first-party cookie with a random visitor ID (lc_vid), and a one-way hash of your IP address that is kept for at most 10 minutes. We use them to count hype stars once per person, hold stock while you check out, and stop bots. They aren't linked to your name or email.
We don't use analytics, advertising pixels, or tracking cookies. See the cookie policy for the small amount of browser storage we use.

We don't collect sensitive information such as government IDs, precise location, or biometrics.

How we use it

To take payment for, make, ship, and support your order, including shipping and delay notices.
To send drop announcements to people who joined the waitlist. Every email has an unsubscribe link.
To text drop alerts to people who gave a phone number and agreed to texts. Reply STOP to any text to stop them.
To plan production: waitlist sizes tell us how many pairs of each size to cut.
To answer your messages and handle privacy requests.
To prevent fraud and abuse, keep the site secure, and meet legal, tax, and accounting obligations.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We don't use it to make automated decisions about you.

Who we share it with

Only with service providers that help us run the shop, under contracts that limit how they use it:

Provider	Why
Stripe	Payment processing and checkout. Stripe collects your card details, name, email, and shipping address directly; we never see or store your full card number.
Resend	Holds the waitlist email list and sends our emails: your sign-up confirmation and drop announcements. It receives your email address and handles unsubscribes.
Formspree	Receives privacy requests submitted on this site and forwards them to us. Email-list sign-ups made before October 10, 2026 were also collected through it.
Vercel	Hosts the website. Like any web host, it processes your IP address and browser details in server logs to deliver and secure the site.
Upstash	Database for waitlist sign-ups (your email, and your phone number, size, and style picks if you gave them), stock holds during checkout, hype-star counts, and anti-abuse rate limits. It also stores a random visitor ID and a one-way hash of your IP address. It holds no addresses or payment details.

We also share your name and address with the shipping carrier that delivers your order, and we may disclose information if the law requires it or to protect our rights, or to a buyer if the business is sold.

How long we keep it

Waitlist (email, and phone, size, and style if you gave them): until you unsubscribe or ask us to delete it.
Order records: up to 7 years, because tax and accounting law requires it.
Messages and privacy requests: up to 2 years after we resolve them.
Hashed IP rate-limit keys: 10 minutes at most. Checkout stock holds: about 40 minutes.
Visitor ID cookie: 1 year in your browser. Hype stars tied to it are deleted after the drop ends.
Server logs: kept by our host for a short period, typically under 30 days.

Your rights and choices

Wherever you live, you can ask us to tell you what we hold about you, correct it, delete it, or stop emailing you. Depending on your state or province (for example California, Colorado, Virginia, or Canada), the law may give you additional rights, including the right to appeal if we decline a request. We won't treat you differently for using any of these rights.

Submit a request here, or email [email protected].
Unsubscribe using the link at the bottom of any email from us.
We'll confirm the request came from you (usually by replying to the email address involved) and respond within 30 days, or tell you if we need longer, up to the time your local law allows.
An authorized agent can make a request for you with your written permission.

We may keep information we're legally required to retain (such as order records for tax purposes) even after a deletion request, and we'll tell you if that applies.

Children

This site isn't directed to children. We don't knowingly collect personal information from anyone under 13, and you must be 13 or older to join the email list. You must be 18or older, or have a parent or guardian's permission, to place an order. If you believe a child under 13has given us information, contact us and we'll delete it.

Security

We use reputable providers, encrypted connections (HTTPS), and limited access to protect your information. No system is perfectly secure; if a breach affects you, we'll notify you as the law requires.

Where your data is processed

We're based in the United States and our providers mainly process data in the U.S. If you're in Canada or elsewhere, your information will be transferred to and stored in the U.S.

Changes

If we change this policy we'll update the date at the top. If a change materially affects how we use information we already have, we'll tell you by email before it takes effect.

Contact

Luh Labs LLC
Appleton, WI 54911, USA
[email protected]