Privacy Policy

This policy explains the information processing that occurs through universalesmokeshop.com and its website features.

Last updated: September 20, 2026

Who This Policy Covers

This policy applies to the website operated for 247 Smoke Shop Sand Lake / Universal Studio. It covers website visits, account sign-in, the cart and order request tools, delivery or pickup request forms, and the website's AI assistant. It does not describe the practices of an unrelated website or service merely because that service links to us.

Information You Provide

• Order requests: name, phone number, requested products and quantities, pickup or delivery selection, delivery address when applicable, notes, prices and request status. The server also records an order number, timestamps, status events, and a hashed form of the request IP address for rate limiting.
• Account and authentication information: when you use sign-in or sign-up, Clerk provides the authentication interface and processes the information used for that account flow. Staff access to stored order requests also uses Clerk authentication.
• AI assistant: the message you enter, recent conversation history, current page, and relevant product context are sent to the website backend. If you choose the microphone feature, the browser's Web Speech API converts speech into text. Depending on the browser and device, its provider may process audio to perform recognition. The site receives the resulting text and handles it as an entered message.
• If you contact the store by email or phone, the information you choose to provide is handled through your email or telephone service and the store's corresponding communication service.

Information Collected Through the Site

Google Analytics is loaded on website pages. Published Replit deployments may also inject an Umami analytics client. These tools measure visits and website interactions. The site sends named interaction events such as age-gate responses, cart actions, checkout outcomes, and selected calls, directions, pickup, delivery, or shop actions when those features are used. Like other web services, the site and these providers receive network and request information needed to deliver requests, which can include an IP address, browser or device information, referring page, and requested page.

The AI assistant sends aggregate event counters to the website backend for events such as opening the assistant, sending a message, selecting an action, or encountering an error. That counter endpoint does not store the message, conversation history, or session identifier. The backend uses a hashed IP-derived key in memory to rate-limit AI requests.

Cookies and Browser Storage

Google Analytics is configured through Google's gtag library and can set or read analytics identifiers in cookies. Clerk can use cookies or browser storage to maintain authentication and related security state. Those providers receive requests when their features load or are used.

The site uses browser storage for functionality. Persistent local storage can hold the age-gate response, cart contents, and local order history. Local order history is limited to the 50 most recently saved requests on that browser. If an order save fails, a retry draft containing contact and fulfillment details can be kept for up to 15 minutes and is removed when it is next found to be expired. These items remain on the device unless the feature clears them, they are replaced, or browser data is cleared.

Session storage can hold the AI conversation, a random assistant session identifier, and an AI order draft for the browser tab's session. Cart, draft, and local history data are transmitted to the server only when a feature requires a request, such as submitting an order or sending an AI message.

How Information Is Used

• to receive, review, update, and fulfill order requests;
• to communicate about a request and check pickup or delivery details;
• to provide account and AI-assistant features;
• to operate, troubleshoot, measure, and protect the website, including rate limiting and duplicate-request handling; and
• to maintain staff-visible order status records.

Service Providers and External Requests

Information is disclosed as needed to services that support the feature being used. Those services include Google Analytics for website measurement, Replit and its injected Umami analytics for hosting and measurement, Clerk for authentication, and OpenAI for AI-generated answers. The backend first handles some store, product, order-draft, and safety questions without OpenAI. For open-ended requests that use OpenAI, the backend sends the message, limited recent history, current page path, and relevant product context. Do not enter sensitive information in the AI assistant.

When at least three characters are entered in a delivery-address field that offers suggestions, the typed address text is sent directly from the browser to the public Photon geocoding service, which uses OpenStreetMap data. Photon also receives the network information associated with that request.

The optional distance checker asks the browser for location permission. If granted, it uses latitude, longitude, and accuracy in the browser to calculate straight-line distance; this website's distance-checking code does not send those coordinates to the website server. A browser, operating system, device, or location provider may process location to provide the browser result.

Pages with an embedded Google map make a request to Google when the map loads. Links to external services are governed by the destination service's practices. Information may also be disclosed when reasonably necessary to respond to legal process, protect rights or safety, investigate misuse, or complete a business transaction, subject to applicable requirements.

Retention and Security

The site does not publish a fixed deletion period for server-side order requests, status events, or account records. They may be retained for operational, recordkeeping, dispute, security, and legal purposes. Browser-storage periods are described above. Third-party providers apply their own retention practices.

Administrative access to order records requires authentication, and IP addresses stored with order requests are hashed. No transmission or storage method can be guaranteed completely secure.

Your Choices and Requests

You can clear this site's browser storage using your browser controls. Browser privacy settings and extensions may also limit analytics or third-party requests, although doing so can affect site features.

You may ask about access, correction, or deletion of information associated with you by contacting the store. Requests are handled subject to applicable law, identity verification, and legitimate operational, security, recordkeeping, and legal obligations; a request does not guarantee that every record can be provided, changed, or deleted.

Age-Restricted Site

This website is intended for people age 21 or older. The age gate stores only an accepted indicator in local browser storage; it is not an identity or age-verification service.

Privacy Contact

Questions or privacy requests may be sent to driftiapp@gmail.com. Include enough information to identify the relevant interaction, but do not email passwords or unnecessary sensitive information.

Policy Changes

This page may be revised when website processing changes. The date at the top identifies the latest posted version.