Effective October 11, 2026 · Last updated October 30, 2026
In short
- Our own site doesn't set cookies or advertise. Stripe sets its own security cookies on the payment step of checkout. We count visits anonymously to improve the shop, and you can turn that off.
- Your cart and hearts live in your browser and clear when you close the tab, unless you save a wishlist.
- The Google map on our home page sets Google's own cookies. In Quebec it waits until you ask for it, and anyone can turn it on or off below.
- If you order or get in touch, we may send you our newsletter for a while (two years after an order, six months after a message or request). Tick "Email me news" to stay on it, and unsubscribe anytime. How it works
- We never sell your information.
This policy explains how My Back Shed Inc. ("My Back Shed," "we," "us," or "our") collects and uses personal information when you visit our website, save a wishlist, or buy from us online. We follow the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
Our website, online shop, and ordering system are built and hosted for us by STOHRX, which acts as our service provider. Card payments are handled by Stripe. Neither is the seller of your order: My Back Shed is.
1. What we collect
When you place an order: your name, email address, phone number, the items you buy, and whether you pick up in the shop or have the order shipped. If it is shipped, we also collect your shipping address. You enter your card on Stripe's secure payment page; we never see or store your full card number.
When you save a wishlist: the email address you enter, the pieces you have hearted, and what is in your cart. See Your wishlist for how it works and an important note about it.
When you contact us or ask for a quote: your name, email address, phone number if you give it, your message, and the piece you are asking about, if any. A quote request can also include the measurements of your piece and up to five photos you choose to upload.
When you ask for a refund: your name, email address, phone number if you give it, your order number, which pieces from that order have a problem, what you tell us about each one, and any photos you upload. Before a photo is sent, your browser makes a smaller copy of it, which also leaves out hidden details stored inside photos, such as where it was taken. If your browser can't open the photo itself (some iPhone photos, on a computer), it is sent as it is, hidden details included; choosing a JPEG photo avoids this. Photos you upload for a quote or a refund are stored with our website images at an address only we and you hold, and are not listed anywhere public.
When you ask us to tell you when a sold piece is back: your email address and the piece you asked about.
When you sign up for our newsletter (in the footer, or by ticking "Email me news" on any of our forms): your email address, when you signed up, and the wording you agreed to.
When you browse: anonymous visit statistics: which of our pages are viewed and for how long, which pieces are opened and added to carts, whether checkout is started or runs into a problem, the kind of device (phone, tablet or computer), and the website you came from. They are tied only to a random code for your browser tab, never to your name, email or order. See Visitor statistics. We do not use advertising tools or tracking pixels. Like any website, the servers that deliver our pages and images see your IP address and basic browser information when they send them to you; we do not use this to identify you.
2. Why we use it
- To take, prepare, and hand over or ship your order, and to contact you about it.
- To work out shipping costs for your address.
- To keep your wishlist and cart so you can come back to them.
- To answer your messages and quote requests.
- To let you know when a piece you asked about is back.
- To send you our occasional newsletter about sales, new arrivals and as-is room drops: if you sign up, and for a limited time after you buy from us or get in touch (see Our newsletter).
- To keep the records we are required to keep for tax and accounting.
- To detect and prevent fraud and misuse of the site.
- To see, in totals, how people use the shop so we can make it easier to use.
We use your information only for purposes a reasonable person would consider appropriate, and with your consent, which you give by placing an order, saving a wishlist, sending us a message, asking us about a sold piece, or signing up for our newsletter.
3. Who we share it with
We do not sell your personal information. We share it only:
- With STOHRX, our website and ordering provider, which stores and processes it on our behalf and under our instructions, using its own technology providers (such as Supabase for the database and Cloudflare for hosting).
- With Stripe (Stripe, Inc. and Stripe Payments Canada, Ltd.), to take your payment and handle any refund or payment dispute. Stripe's own privacy policy governs your card details.
- With Canada Post, when you choose shipping: your shipping address and the parcel details, to quote a price and deliver your order.
- With Resend, the email service that sends our newsletter and the confirmation emails for refund and quote requests: your email address and the contents of that email, only so it can send them on our behalf.
- When required by law, such as in response to a court order.
- In a business transaction, such as a sale of the shop, where the buyer agrees to handle your information consistently with this policy.
4. Storage outside Canada
STOHRX's technology providers, Stripe, Resend, and the outside services listed in section 6 may store or process information outside Canada, including in the United States, where it may be accessible to authorities under that country's laws.
5. How long we keep it
- Orders: for as long as needed to provide and support your order and to meet our tax and accounting obligations (generally six years).
- Wishlists: until you clear it, or until you ask us to delete it.
- Messages and quote requests: for as long as needed to answer them and follow up, or until you ask us to delete them.
- Refund requests: for as long as needed to resolve them and to meet our tax and accounting obligations for the order (generally six years), or the photos sooner if you ask us to delete them.
- Requests to hear when a piece is back: for as long as needed to let you know, or until you ask us to delete them.
- Newsletter: if you signed up, until you unsubscribe; otherwise for the two years after your purchase or six months after your message or request (see Our newsletter), or until you unsubscribe, if sooner.
- Visitor statistics: 90 days, then deleted.
- Information in your browser: see the table in section 6. Most of it is erased automatically when you close the tab.
6. Cookies, browser storage, and outside services
Our own site does not set any cookies. The only cookies come from Google, when the map on our home page loads (see Google Maps below), and from Stripe, on the payment step of our checkout (see Paying with Stripe below). Our site keeps a few small items in your browser's own storage so that it works: your cart, your hearts, your checkout progress, and a short-lived copy of our product list so pages load faster. These are needed for the site to function, are not used to track you, and are never shared with anyone for advertising.
What our site keeps in your browser
| Item | What it is for | How long it stays |
|---|---|---|
mbs_cart | The pieces in your cart | Until you close the tab |
mbs_favourites | The pieces you have hearted | Until you close the tab |
mbs_checkout | Your checkout progress (contact details, pickup or shipping choice, shipping address), so a refresh doesn't lose it | Until you close the tab |
mbs_resume | Whether we have already offered to bring back your saved wishlist this visit | Until you close the tab |
mbs_q_ and a name (such as mbs_q_items, mbs_q_categories, mbs_q_shipping, mbs_q_pages) | A copy of our product list, collections, sales, page text and shipping options, so moving between pages doesn't download them again. Nothing about you. | Until you close the tab; refreshed every two minutes |
mbs_sid, mbs_ref_sent | A random code for this tab, so the visitor statistics count one visit rather than every page separately, and whether the website you came from has already been noted | Until you close the tab |
mbs_analytics_optout | That you turned visitor statistics off (only set if you do) | Until you turn them back on below, or clear your browser's site data |
mbs_scroll: and the page's address | Where you were on a shop page, so coming Back from a piece returns you to the same spot | Until you close the tab; removed as soon as it is used |
mbs_preview_scroll | Only while the shop previews this site inside its own website editor: where the preview was scrolled to, so it stays put when the preview refreshes. Never set for visitors. | Until that tab closes; removed as soon as it is used |
mbs_doors_seen | That the opening doors on our home page have already played this visit | Until you close the tab |
mbs_wishlist, mbs_wishlist_email | Which saved wishlist is yours on this browser, and its email, so your hearts and cart keep saving to it | Until you choose "Not you?" in the Wishlist, or clear your browser's site data |
mbs-gallery-hero | The address of the Gallery page's top photo, so it appears faster next time | Until you clear your browser's site data |
mbs_maps | Your choice to show or hide the Google map (see below; only set once you choose) | Until you change it below, or clear your browser's site data |
"Until you close the tab" means session storage: it is erased when that browser tab closes. The others are local storage and stay on your device until removed. You can remove all of them at any time by clearing this site's data in your browser's settings.
Your wishlist
When you enter your email in the Wishlist, your hearted pieces and cart are saved under that email address, so you can open the same list on another phone or computer by entering the same email. Your wishlist is not password-protected: anyone who enters your email address on our site can see and change it. Please don't save anything you would want to keep private. Clearing your wishlist (the "Clear wishlist" button) also clears the saved copy. A wishlist with nothing saved on it is deleted after a day.
Google Maps on our home page
The "Visit the Shop" section of our home page shows a map of our location from Google Maps. When the map loads, Google sets its own cookies and receives your IP address and browser information, under Google's privacy policy.
If you are in Quebec, or your browser sends a Global Privacy Control or Do Not Track signal, the map is off until you click "Show map" on the home page (or turn it on below). To know whether you are in Quebec, our website host works out your province from your connection when the page loads; it is used only for this and is not stored.
Anyone can turn the map on or off for this browser in Your choices below, and we remember the choice (mbs_maps, above). When it is off, the home page shows a "Show map" button in its place. Turning it off stops the map from loading; to remove cookies Google has already set, clear your browser's cookies for google.com.
Visitor statistics
Our site counts visits in a simple, anonymous way so we can see, in totals, what is working: for example how many visitors open a piece, add it to their cart, or start checkout. The counts are sent to STOHRX, our website provider, and kept for 90 days. They are linked only to a random code that lasts until you close the tab (mbs_sid, above), never to your name, email address, IP address or order. Nothing you type is recorded, and nothing is used for advertising or shared with anyone else. The statistics are off if your browser sends a Global Privacy Control or Do Not Track signal, and you can turn them off for this browser in Your choices below.
Paying with Stripe
On the payment step of our checkout, you enter your card in a secure form that Stripe runs inside our page. Your card details go straight to Stripe and never reach our site. To show that form, Stripe's code loads on that step only and sets Stripe's own cookies (such as __stripe_mid and __stripe_sid) for payment security and fraud prevention, under Stripe's privacy policy. If the form can't load, we take you to Stripe's own payment page instead, where the same applies.
On devices that support them, that step also offers Apple Pay, Google Pay and Link (Stripe's way to save your card for faster checkout). They're only used if you choose them: Apple Pay and Google Pay pay with the card already in your phone or browser, under Apple's or Google's own privacy terms, and Link keeps your card with Stripe only if you sign up for it there. We never see or keep your card details either way.
Other outside services our pages load
To show our pages, your browser also fetches fonts from Google Fonts, some photos from Unsplash, our Instagram photos from Instagram, and site code from the jsDelivr network. These services receive your IP address and basic browser information when they deliver these files, as any website you visit does. Our site does not let them set cookies or track you, and they are not used for advertising.
What we don't use
No advertising cookies, no tracking pixels, no outside analytics services, and no "session recording" of what you type or click.
Your choices
Google map on our home page
On: the map loads on our home page, and Google sets its cookies.
Visitor statistics
On: anonymous counts of visits and steps, no cookies.
- Wishlist on this browser: "Not you?" in the Wishlist stops this browser from saving to your list and empties its hearts and cart here.
- Everything else: clear this site's data in your browser's settings.
7. Your rights
Under PIPEDA you can ask to see the personal information we hold about you, ask us to correct it, or withdraw your consent to certain uses (subject to legal limits and reasonable notice), including asking us to delete your wishlist. To make a request, contact us using the details below. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.
8. Children
Our shop is intended for adults. We do not knowingly collect personal information from children.
9. Changes
We may update this policy. We will post the new version on this page with an updated date.
10. Who is responsible, and how to reach us
My Back Shed has a Privacy Officer, the owner of the shop, who is responsible for how we handle personal information and for this policy. If personal information we hold is ever lost or accessed without permission in a way that creates a real risk of significant harm, we will tell the people affected and report it to the Office of the Privacy Commissioner of Canada, as the law requires.
Privacy Officer, My Back Shed Inc.
131A Kerr Street, Oakville, Ontario L6K 3A6
905.847.2922