Privacy Policy
1. Who This Applies To
This Privacy Policy applies to all visitors and customers of elebe.ca and any related services operated under the elebe brand. By using this site, you consent to the practices described here.
elebe is operated by an individual creator based in Quebec, Canada. We are subject to the Act respecting the protection of personal information in the private sector (Law 25 / Quebec) and, where applicable, Canada's PIPEDA.
2. What We Collect & Why
| Data | Why We Collect It | How Long We Keep It |
|---|---|---|
| Email address | To send your receipt, answer you about an order, and — if you create an account — to sign you in and recover it | While the account or order record exists; deleted on request |
| Name & shipping address | To post your order. Entered on our payment provider's page and copied onto the order so it can be packed | Kept with the order as proof of what was sent, for as long as tax and dispute records require |
| Order details | What you bought, what you paid, what postage you chose, and whether it was sent, refunded, or disputed | As long as tax and dispute records require |
| Payment information | Handled entirely by Stripe on Stripe's own page. We never see, receive, or store your card number — not even the last four digits. We keep only Stripe's reference for the payment | Not stored by us |
| Account credentials | If you create an account: a one-way cryptographic hash of your password, never the password itself, plus session tokens stored only as hashes | Until you delete the account |
| Collection & play | If you use the games or the collection: which pieces you have unlocked, your chosen handle, and your run times, so they persist across devices | Until you delete the account |
| IP address / browser info | Server logs, rate limiting, and abuse prevention | Up to 30 days |
| Site analytics (aggregate) | Understanding general traffic — page views, referral sources | Anonymized, no personal identifiers |
We do not collect sensitive personal data (health, financial, ethnic, or political information). We do not collect data on children under 13 and do not knowingly allow them to submit personal information.
3. Accounts, Buying as a Guest, and Playing
Buying without an account. You do not need an account to buy. When you check out as a guest, we create a minimal customer record attached to the email address you give us, so that your order has an owner, your receipt can reach you, and we can answer you about it later. That record holds your email address and your orders, and nothing else.
It is not an account: it has no password, it does not sign you in, and it gives no access to anything on this site. If you later create an account with the same address, that record becomes your account and your earlier orders appear in it. If you would rather it did not exist at all, ask us and we will delete it, subject to the records we are required to keep for tax and dispute purposes.
Wallet payments. If you pay with Apple Pay or Google Pay, Apple or Google passes your name, email address, and shipping address to our payment provider, and we receive them from it. Their handling of your data is governed by their own privacy policies, not this one. If you use Apple's Hide My Email, we receive a forwarding alias rather than your real address, and we treat it exactly as we would any other address you gave us.
Playing without an account. The games can be played without signing up. When you do, we keep an anonymous record — a generated handle and your progress — so that a run you finished is still yours when you come back, and so it can become a real account later if you choose to make one. It is not linked to your name or your email address, because we do not have either until you give them to us.
What we never do. We do not treat a payment as proof that you own an email address. Paying for something never confirms your address, never creates a password, and never signs you in. The only way to turn a customer record into a working account is to set a password through a link sent to that address — which proves you can read the inbox.
4. Cookies & Tracking
This site uses minimal cookies. We do not use advertising cookies, cross-site tracking pixels, or behavioral profiling tools.
- Essential cookies — required for the site to function (e.g., cart session). Cannot be disabled without breaking site functionality.
- Analytics cookies — lightweight, anonymized traffic data only (e.g., page visits). No personal identifiers are attached.
You can disable cookies in your browser settings at any time. Disabling essential cookies may affect your ability to complete a purchase.
5. Third-Party Services
We use a small number of third-party services to operate the site. Each has its own privacy policy:
- Stripe (payments) — receives your payment details, name, email, and shipping address directly. We never receive your card number. Includes Apple Pay and Google Pay where your device offers them.
- Resend (email delivery) — sends your receipt, verification, and password-reset messages. Receives your email address and the contents of those messages.
- Neon (database, United States) — stores your account, orders, and collection.
- DigitalOcean (hosting) — runs the site and keeps short-lived server logs.
- Supabase (authentication and file storage) — where used for signing in.
- Google Analytics and Microsoft Clarity (aggregate analytics) — page views and referral sources. No personal identifiers are attached and neither is used for advertising.
- Canada Post and any onward carrier — receive your name and address in order to deliver your parcel.
We do not share your data with any party for advertising, resale, or marketing purposes.
6. How We Use Your Information
- To process and fulfill your order;
- To send transactional emails (confirmation, tracking, issue resolution);
- To respond to questions or support requests you initiate;
- To detect and prevent fraud or unauthorized activity;
- To detect and prevent fraud, abuse, and attempts to obtain unlocks other than by playing;
- To tell the shop owner that a sale has happened, so your order can be packed;
- To comply with legal obligations under applicable law.
We will never use your email for marketing without your explicit opt-in. There are no mailing lists you are added to automatically.
7. Commercial Email & CAN-SPAM Compliance
If we ever send commercial or promotional email (for example, a new-drop announcement), we comply with the U.S. CAN-SPAM Act, Canada's Anti-Spam Legislation (CASL), and other applicable laws. Specifically:
- We send marketing email only to people who have explicitly opted in. We do not buy, rent, or scrape email lists.
- Our "From," "To," and "Reply-To" fields and routing information are accurate and identify elebe as the sender.
- Subject lines reflect the actual content of the message and are not deceptive.
- Promotional messages are identified as such and include our valid physical postal mailing address.
- Every marketing email includes a clear, working unsubscribe link. We honour opt-out requests promptly — within 10 business days — and do not sell or transfer the email address of anyone who unsubscribes.
Transactional emails (order confirmations, shipping updates, replies to your inquiries, account and security notices) are not promotional and may be sent regardless of marketing preferences, as permitted by law.
To unsubscribe at any time, use the link in any marketing email or contact [email protected]. Our postal mailing address, included in all commercial email, is:
elebe
PO Box 1
QC G6X 1C2
Canada
8. Your Rights (Canada)
Under Quebec's Law 25 and applicable Canadian law, you have the right to:
- Access — request a copy of the personal data we hold about you;
- Correct — request corrections to inaccurate information;
- Delete — request deletion of your data, subject to legal retention requirements;
- Withdraw consent — where processing is based on consent, you may withdraw it at any time;
- Complain — file a complaint with the Commission d'accès à l'information du Québec (CAI) if you believe your rights have been violated.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
9. Your California Privacy Rights (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding your personal information. This section applies to you in addition to the rights described above.
Categories of personal information we collect. In the past 12 months we have collected the following categories of personal information, as defined by the CCPA:
| CCPA Category | Examples We Collect | Source |
|---|---|---|
| Identifiers | Name, email address, shipping address, IP address | You, directly at checkout or contact |
| Customer records | Shipping details and order history tied to your purchase | You, directly at checkout |
| Commercial information | Products purchased and transaction records | You / our payment processor |
| Internet / network activity | Pages visited, aggregate analytics, basic server logs | Automatically, via your browser |
We collect this information for the business purposes described in Section 5. We do not collect sensitive personal information as defined by the CPRA, and we do not use or disclose any such information for purposes that would trigger the right to limit its use.
We do not sell or share your personal information. elebe has not sold and does not sell personal information, and does not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have no actual knowledge of selling or sharing the personal information of minors under 16.
Your California rights. Subject to certain exceptions, you have the right to:
- Know / Access — request the categories and specific pieces of personal information we have collected, the sources, the business purpose, and any third parties with whom it was shared;
- Delete — request deletion of personal information we collected from you;
- Correct — request correction of inaccurate personal information;
- Opt out of sale/sharing — though we do not sell or share your information, this right is available to you;
- Limit use of sensitive information — though we do not collect sensitive personal information that would require this;
- Non-discrimination — we will not deny service, charge a different price, or provide a different quality of service because you exercised any of these rights.
How to exercise your rights. Submit a request by emailing [email protected] with "California Privacy Request" in the subject line. We will verify your request using information associated with your account or order before responding, and will respond within 45 days (extendable by an additional 45 days where permitted). You may use an authorized agent to submit a request on your behalf with proof of authorization.
10. Data Security
We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, loss, or disclosure. However, no method of transmission over the internet or electronic storage is 100% secure.
Payment data is never transmitted through or stored on our servers — it is handled exclusively by our payment provider's PCI-compliant infrastructure.
In the event of a data breach that poses a risk to your rights, we will notify affected individuals and the appropriate authority as required by law.
11. Data Retention
We retain personal data only as long as necessary to fulfill the purposes described above or as required by law. Order records may be retained for up to 7 years for accounting and tax purposes. You may request deletion of non-legally-required data at any time.
12. International Data Transfers
Your information is primarily stored and processed in Canada. If a third-party service transfers data internationally (e.g., a US-based payment processor), it does so under appropriate safeguards consistent with Canadian law. By using this site, you acknowledge this possibility.
elebe is operated from Canada and this Privacy Policy is governed by Canadian law. We welcome visitors and customers worldwide; if you access the site from outside Canada, you understand that your personal information will be transferred to, stored in, and processed in Canada and other countries where our service providers operate, which may have data-protection laws that differ from those in your country. By using the site or placing an order, you consent to this transfer and processing. Where local mandatory privacy law grants you additional rights (such as the GDPR in the EU/UK, or the CCPA/CPRA in California), we honour those rights to the extent they apply to you; for California-specific rights, see Section 8 above.
13. Children's Privacy
This site is not directed to individuals under the age of 13. We do not knowingly collect personal information from children. If you believe a child has submitted personal information to us, please contact us immediately and we will delete it promptly.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, the revised version will be posted here with an updated effective date. We encourage you to review this page periodically. Continued use of the site after changes constitutes acceptance of the updated policy.
15. Contact & Privacy Inquiries
For any privacy-related questions, requests, or concerns:
elebe · PO Box 1 · QC G6X 1C2 · Canada
We aim to respond to all privacy requests within 30 days.