Privacy

Last updated October 2026

We collect what we need to make and ship your model, and measure which ads and pages bring people here. We never sell your data.

What we collect

• Your order: the map area, options, plaque text and gift note you choose. Your order page (the link in your receipt) shows its progress; anyone with that link can see the order, so keep it to yourself.
• Tiny Race and Tiny Outdoors: the line of your route, simplified to a few metres. Your GPX file is read in your browser; no times, heart rate or other data from your watch reach us. When you draw a route on the map, the points you tap go to our server so the line can follow the streets. The line goes with your order, to Stripe and our order records, and in the link when you email yourself your design or send it with a message; we use it only to make your model.
• Gift cards: the names and message on the card, and who bought it.
• Checkout details: name, email, phone and shipping address, collected by Stripe. We never see or store your card number.
• Email sign-up: your email address, only if you join the order-by reminder list.
• Design by email: if you ask for your 3D preview by email, your email address, the design, how you found us and your IP address to stop abuse. We send the design once, and add you to the reminder list only if you tick the box.
• Unfinished checkouts: if you agree to emails from us at checkout but don't finish, we email you once with a link back to your order.
• Your approximate city: Cloudflare works it out from your IP address so the map can open near you. We don't store it.
• Messages: your name, email, order number and message, and any photos you add, if you use the contact form or "Message us", with your IP address to stop spam. A message sent from the designer includes a link to the design on your screen. They go to our inbox and a copy is kept with our order records. Your name, email and message may also come to our phone as a text.
• Reviews: the stars, review, name and place you enter on the review form, and your OK to show them on our site. Nothing goes on the site until we've read it.
• Review request: once your model has had time to arrive, we email you once to ask for a review. We don't ask about gifts, or once you've left a review.
• Your orders page: when you sign in, your email address and a one-time code (kept only as a scrambled copy), plus your IP address to stop abuse.
• How you found us: the ad or link you arrived from (campaign tags and ad click IDs in the web address), the pages you view and the options you try. Stored with your order so we know which ads work.

Who handles it

• Stripe processes payments.
• Supabase stores our order records, in Canada.
• Resend sends order emails, design emails, reminders, review requests, contact form messages and reviews.
• Twilio sends us a text with your name, email and message when you write to us.
• Cloudflare hosts the site.
• Google (Google Analytics and Google Ads) and Meta (the Meta pixel and Conversions API) measure visits and ad results. When you order, we send them the order value and a scrambled (hashed) copy of your email, phone and address so they can match the sale to the ad you clicked. If you ask for your design by email, Meta gets a scrambled copy of that email address the same way. They can't read the hashed details back.
• Geoapify receives what you type in the place search, through our server, so it doesn't see your IP address. If it's unavailable, your search goes to OpenStreetMap (Nominatim) instead. OpenFreeMap serves the map tiles. Amazon Web Services serves the ground heights for hills. Overture Maps (tiles.overturemaps.org) serves building heights. OpenStreetMap's Overpass servers (overpass-api.de and overpass.kumi.systems) send the map data when our own server can't. FOSSGIS (routing.openstreetmap.de) finds the way along streets and paths when you draw a route on Tiny Race or Tiny Outdoors, through our server, so it doesn't see your IP address. jsDelivr and unpkg serve the code libraries for the 3D preview and the map. Google Fonts serves the fonts. These services see your IP address, like any website you load.

Some of these companies store data outside Canada, including in the United States.

Cookies

Google and Meta set cookies to measure visits and ads. Visitors in Quebec, the EU, the UK and Switzerland are asked first; anyone can change their choice with "Cookie choices" at the bottom of every page. If you decline, we don't send your order to Google or Meta either. "Save for later" keeps your design in your own browser only (so does the route you add on Tiny Race or Tiny Outdoors), and "Message us" keeps your name, email and the messages you sent there too, so the conversation is still there next time. Signing in to "Your orders" sets one cookie of our own that keeps you signed in for 30 days; signing out removes it.

What we don't do

We don't sell your data or share it with anyone besides the services above.

How long we keep it

• Orders and gift cards: six years after the end of the tax year you bought in, because Canadian tax law requires us to keep business records that long. That includes the name, address and design on each order.
• Sign-in codes for Your orders: a code works once, for 15 minutes. We clear old codes, and the IP address that asked for them, within 30 days.
• The reminder list: until you unsubscribe.
• Everything else: only as long as we need it for the reason we collected it, then we delete it.

Your choices and rights

Every reminder email has an unsubscribe link. To see, correct or delete what we hold about you, email hello@tinyhometown.com. We reply within 30 days. Order records that tax law makes us keep can't be deleted early, but we use them for nothing else.

If you're unhappy

Please tell us first, and we'll try to put it right. You can also complain to a privacy regulator:

• In British Columbia: Office of the Information and Privacy Commissioner for British Columbia
• Anywhere in Canada: Office of the Privacy Commissioner of Canada
• In the UK: Information Commissioner's Office
• In the EU, Norway, Iceland and Liechtenstein: your country's data protection authority
• In Switzerland: Federal Data Protection and Information Commissioner
• Anywhere else: your own country's privacy regulator