Privacy policy
Privacy at The Smoke Hut
Effective October 1, 2026
We collect as little as we can to run the shop and get your order to you. This page explains what we collect, why, who helps us handle it, and how long we keep it.
The short version
- We use Google Analytics to see how the shop is used, but only if you say yes. Advertising measurement runs only if you say yes (see Advertising below).
- You don't need an account to shop.
- Your card number never touches our website.
- We only share your details with the companies that help us take payment, fill your order and deliver it.
The age check
When you confirm your age, your browser remembers it for 30 days so you don't have to re-enter it every visit. The date of birth and province you type in stay in your browser. They aren't saved, and they aren't sent to us.
Cookies
We use a few cookies the shop needs to work: one for the age check, one to remember your cookie choice (kept for 12 months), and one that links you to your cart. The cart cookie holds a random number, not your name or any personal details. The checkout page may set a few cookies of its own.
Optional cookies. If you choose "Accept all" on the cookie notice, we turn on Google Analytics. It sets cookies (named _ga and similar) that hold a random number so we can tell visits apart. It tells us things like which pages and products people look at, what they search for, what they add to their cart, and roughly where they are (city level, worked out from your IP address). It doesn't tell us your name, email or address, and we don't send those to Google. We've switched off Google's advertising features, so this information isn't used to show you ads.
If you choose "Essential only", none of this loads. You can change your mind any time with Cookie settings at the bottom of every page. Switching to "Essential only" stops the tracking and removes the analytics cookies.
Your cart
We keep the items in your cart so they're still there when you come back. Carts are deleted about 30 days after you last change them.
Placing an order
When you check out, you give us your name, email, shipping address and phone number. We use them to process your order, ship it, and contact you about it. Our store platform, Ecwid, stores your order details.
Paying
Payment happens on our secure checkout, powered by Ecwid, and card payments are processed by Moneris, a Canadian payment company. Your card details go directly to them. Our website never receives or stores your card number.
Delivery
Canada Post receives your name and address to deliver your order. Because of what we sell, they'll ask for government-issued ID at the door to confirm your age.
How our staff handle your order
Our staff look up orders through the shop's admin area to pack, ship and answer questions. Sometimes they use an AI assistant to help with that work. When they do, the order details they're working on, including your name, email and address, are shared with that assistant.
Who helps us run the shop
- Ecwid: our store platform. It runs checkout, stores orders and shows product photos. When images load, your IP address reaches Ecwid and its image delivery network, Amazon CloudFront.
- Moneris: processes card payments.
- Canada Post: delivers orders.
- Supabase: hosts the database that stores carts.
- Vercel: hosts this website. It keeps standard visit logs, including IP address and browser type.
- Google (Google Analytics): measures how the shop is used, only if you accept optional cookies.
Some of these companies may store or process information outside Canada. When that happens, the laws of that country apply to it.
How long we keep things
- Age check: 30 days.
- Cookie choice: 12 months.
- Cart: about 30 days after it was last changed.
- Order details: for as long as Ecwid holds your order record, or until you ask us to delete them, unless we're legally required to keep them longer.
- Website visit logs: as long as Vercel's standard retention period.
- Analytics cookies: up to 12 months in your browser, or until you switch them off.
- Analytics data at Google: 2 months for visit-level records. Summary totals with nothing that identifies a visitor are kept longer.
Your choices and rights
You can ask to see the information we have about you, ask us to correct it, or ask us to delete it. You can also withdraw your consent, though we may not be able to complete an order without the details it needs. Email contact@thesmokehutpa.ca and we'll respond within 30 days.
If you're not happy with our answer, you can contact the Office of the Privacy Commissioner of Canada.
Age
This shop is for adults. We don't knowingly collect information from anyone under the legal age.
Changes to this page
If we change how we handle your information, we'll update this page and the date at the top.
Contact
For privacy questions or requests, email contact@thesmokehutpa.ca.
Advertising
- If you choose "Accept all" on the cookie notice, we also turn on advertising measurement by ChatGPT Ads (OpenAI). When you place an order, it tells OpenAI that an order was placed, with its total and currency, so we can see whether one of our ads in ChatGPT led to it. We don't send OpenAI your name, email, address or what you bought.
- OpenAI's code sets two cookies: one that remembers which ad you came from (up to 30 days) and a random browser reference (up to 12 months). It can also pick up contact details typed into our pages, including at checkout, and send a scrambled (hashed) form of them to OpenAI. We can't switch that part off, which is one reason it only runs if you say yes. See OpenAI's privacy policy.
- If you choose "Analytics only" or "Essential only", none of this loads. You can change your mind any time with Cookie settings at the bottom of every page. Switching it off stops it and removes its cookies.