Privacy policy

This page explains what undertherugmusic.com collects about you, why, and who else sees it. It covers the whole site: the store, the mailing list, and the Secret Hideout. When it says we, it means Under the Rug, the band, and the business behind it, Kochi Parr, LLC.

The short version

• When you join the mailing list, we collect your email address, and your first name and ZIP or postal code if you give them. We use them to send you letters from the band.
• Shopify runs the store's checkout. Stripe takes payments for Hideout memberships, which MemberSpace runs for most members. They collect what they need to take your order or your payment.
• We measure visits and ads with Meta Pixel and Google Analytics. They never load in the Secret Hideout.
• We don't sell or rent your information, and we don't show ads on this site.

The mailing list

When you sign up, we send your email address to Drip, the service we write our letters in, with your first name and ZIP or postal code if you give them. Your ZIP or postal code lets us write to just the people near a show, like when one is canceled on the day. Drip keeps what you sent, when you signed up, and a tag for the form you used, so we can tell a homepage signup from one for a new record. Drip also notes when you open a letter or click a link in it.

Every letter has an unsubscribe link at the bottom. You can also email us and we'll take you off the list.

Drip's privacy policy: drip.com/privacy-policy.

The VIP pass

If you use the VIP pass form from the first edition of Pale King, we save your name, your email address, and the show you're going to, so we can put you on that show's VIP list and write to you about it. We get each request by email through Resend, an email service, and a note with your name and the show goes to the private Discord channel our moderators use. The form also saves a scrambled code made from your IP address, only so one connection can't send hundreds of requests, and erases it from requests more than an hour old when the next one comes in. Email us to have a request deleted.

The store

Our store runs on Shopify. When you add something to your cart, your browser talks to Shopify directly, and this site keeps your cart's ID in your browser so the cart is still there when you come back.

Checkout happens on Shopify's own pages. That's where you give your name, address, and payment details. Shopify handles them under its own privacy policy, and we see your order so we can send it to you. Shopify's privacy policy: shopify.com/legal/privacy.

The Secret Hideout

MemberSpace runs most Hideout memberships: joining, changing your plan, and billing you through Stripe. Its sign-up box loads on Hideout pages and keeps its own cookies. MemberSpace's privacy policy: memberspace.com/privacy.

If the Hideout signs you in with a link or a 6-digit code we email you, we check your email address with Stripe, which takes every membership's payments, or against the band's own list of free members, to confirm you're a member. Resend, an email service, delivers the email, and we keep a note of the code we sent, filed under a scrambled form of your email address, so each code works once and wrong guesses are limited. A cookie called utr_hideout then keeps you signed in for 180 days. It holds your email address and is signed, so it can't be changed or faked. Stripe's privacy policy: stripe.com/privacy.

Lift the Rug. Your streaks, stats, and progress stay in your browser. If you post a score to the daily board, we save the name you type, the day, and the patches you lifted, with a scrambled ID so each player gets one score a day. The ID is made from your email address if you signed in to the Hideout with a link or code we emailed you, or from a random code your browser keeps. The scrambling can't be undone, so the board never stores either one. The moderators can delete any score.

Liner Notes. Your guesses and stats stay in your browser. Each guess goes to the site to get its number and isn't saved. So no one can flood the game, the site counts each minute's requests under a scrambled code made from your IP address, and from your email address if you signed in to the Hideout with a link or code we emailed you. It erases those counts once they're a day old, when the next request comes in.

Birthdays. If you ask the moderators to put your birthday on the Hideout calendar, we keep your handle and the month and day, never the year, and your Discord user ID if you want a mention in the monthly post. Only members the site has signed in and the moderators can see it. Ask a moderator to take it off at any time.

Comments. If you comment under a Hideout post or fan letter, we save what you write, when you wrote it, and the name you pick, which members who can read the post see with your comment. We keep your email address with your name so your comments stay yours, and only the band and the moderators see it, in the site's admin. We also count your comments each day, filed under a scrambled form of your email address, so nobody can post too many at once. You can delete your own comments, and the moderators can hide or delete any comment. Email us and we'll delete your name, your email address, and all your comments.

Fan letters. If you send the band a letter, it only goes in the Hideout if you say that's OK. It shows with your first name or initials, unless you ask for more, and the day it came, and members can comment on it. Its scans are kept like the site's other pictures, so anyone with a scan's address can open it. Email us and we'll take it down.

Mailing addresses. The band mails members who pay $20 or more a month letters and gifts. So if you're one of them, we keep the name and mailing address you give us, on Stripe's page when you join or on your Hideout account page, only to mail you the band's letters and gifts. Only the band sees it, in the site's admin. You can change or remove it on your account page at any time, or email us and we'll delete it. Once it's deleted, it's gone from the site, and from our database backups when they expire. Stripe also keeps the address you give on its page with your payment, under its own privacy policy.

Membership emails. If you join the Hideout on this site, we email you about your membership: a welcome with your sign-in link, a receipt for each payment, a note if a payment fails or needs confirming, when you cancel, a few days before your membership or a free month ends, and when it ends. We read what they say from Stripe as we send them, and Resend, an email service, delivers them. If you type your email address into Join and don't finish, we may keep it for about a day, only to send you two short emails asking whether something went wrong, unless you join in between. Then it's deleted.

Visits and ads

We use Meta Pixel and Google Analytics to learn how people find the site and whether our ads work. They load after the rest of the page, and never in the Secret Hideout or the band's admin.

They record the pages you visit, when you add something to your cart, and when you start checking out, along with what your browser sends to every site, like your IP address, device, and browser. They set cookies, such as _fbp for Meta and _ga for Google, to recognize your browser when you come back. Meta and Google handle this under their own policies: Meta's privacy policy and Google's privacy policy.

The site works the same if you block them with your browser's privacy settings or a content blocker. Google also offers a browser add-on to opt out of Google Analytics, and you can control the ads Meta shows you in your Facebook or Instagram ad settings.

Hosting

Vercel hosts the site. Like any web server, it logs each request, including your IP address, your browser, and the page you asked for, and keeps those logs for a short time to run the site and keep it secure. Vercel's privacy notice: vercel.com/legal/privacy-notice.

Cookies and browser storage

• Your cart: the ID of your Shopify cart, kept in your browser.
• Lift the Rug: your progress, streaks, and the random code for the board, kept in your browser.
• Liner Notes: your guesses and stats, kept in your browser.
• Hideout sign-in: the utr_hideout cookie, only if you sign in with a link or code we email you.
• MemberSpace: its own cookies on Hideout pages.
• Meta Pixel and Google Analytics: their cookies, on every page outside the Hideout.

Children

This site isn't meant for children under 13, and we don't knowingly collect their information. If you think a child has signed up, email us and we'll delete it.

Your choices

You can ask us what we have about you, ask us to correct it, or ask us to delete it. Email us at customerservice@undertherugmusic.com. Depending on where you live, laws like the GDPR in Europe or the CCPA in California give you more rights, and we'll honor them.

Changes

If we change how the site handles your information, we'll update this page and the date at the top.

Contact

customerservice@undertherugmusic.com

Kochi Parr, LLC, 8998 SW Leahy Rd, PMB 1115, Portland, OR 97225