Privacy Policy
Effective October 8, 2026 · Period Plus, LLC
Updated October 8, 2026: when you tap Subscribe on our Build a box page, its count now also notes how many items were in the box. It still holds nothing about you or which products you picked, and we still delete it after 24 months. We also said that our campaign label is kept with the build page's counts and question, not only with an order.
Updated October 3, 2026: our Build a box page may now ask one optional question of people who leave without subscribing: what stopped them. Its count now also notes when Subscribe is tapped, and it records which offer the page was showing instead of only whether an offer link was used. An answer to the question keeps only the answer tapped, the plan and offer the page was showing, our own campaign label and the hour. None of it holds anything about you, and we delete it all after 24 months. We changed “Always on” and the short version to match.
Updated October 3, 2026: we added what we keep about people who work with us on posts, and about giveaway winners, to “What we collect”, including who handles it and how long we keep it. We also said that links we give to people who post about us carry our campaign label too, and where your answer to the cookie banner is kept if your browser won't store it.
Updated September 27, 2026: our Build a box page now counts how many boxes get completed and how many subscribe attempts fail. Each count holds the plan, whether an offer link was used, our own campaign label, an error code and when it happened, and nothing about you or the products you picked. We delete the counts after 24 months. We changed “Always on” and the short version to match.
Updated September 27, 2026: we now take quote requests from organizations. Added what that form collects to “What we collect”, named Gmail as where those requests are read, and said how long they are kept. Nothing about how we handle a personal order changes.
Updated September 23, 2026: our tally of how people find us now counts every arrival from outside the site, not only visits through our tagged links. For those visits it records only the broad kind of site that sent you, never that page's address, and it still holds nothing about you. We changed “Always on”, the short version and the note on unlabelled links to match.
Updated September 23, 2026: you can now ask us to email you when the Opening Statement can be ordered. Added that to “What we collect” and “How long we keep it”. We keep only your email address and the date you asked, use it for that one email and nothing else, never give it to an advertising platform, and delete it afterwards. It doesn't put you on our mailing list. We also took The Opening Statement out of the note about orders placed without an account, because it can't be ordered right now.
Updated September 23, 2026: if you subscribe, each of your boxes now has a name you can change, so a household with more than one box can tell them apart. Added “Box name” to “What we collect”, and said in “Children” and “How long we keep it” how we handle a name that belongs to a family member. It is never sent to any advertising platform.
Updated September 20, 2026: when you arrive through one of our own tagged links, we now keep a one-line tally of it: the campaign label, the page, the hour, and the country and state, and nothing about you. It runs whether or not you agree to the banner, and no advertising platform receives it. See “Always on” below.
Corrected September 20, 2026: until today, if you used the shop's filters or its search box, those choices appeared in the web address of the page, and the web address is one of the things Google Analytics receives. That does not match what the bullet below says about absorbency, so we are putting it right rather than leaving it. It was never sent to Meta, which only ever received our domain name and no page address at all. Nobody placed an order in that time, so no purchase details were involved either. We have changed the shop so those choices stay in your browser and never enter the address, and we have separately told Google to discard them if they ever appear again.
Updated September 16, 2026: our web host, Netlify, now counts visits to this website: how many times each page is shown, roughly how many different visitors arrive, where they came from and roughly where they are. Nothing is added to the page or stored in your browser for this, and we don't share it with any advertising platform. See “Always on” below.
Updated September 15, 2026: the emails we send now tell us whether they were opened and which links in them were clicked. This covers every email from us, including order and account emails, not only marketing. See “In our emails” below.
Updated September 12, 2026: when you arrive from a link we tagged ourselves, such as one of our ads, we now note which campaign it was and save that label with your order, so we can tell which ads actually lead to orders. It stays with us. See “Always on” below.
Updated September 9, 2026: we corrected who actually touches your information: we named Pirate Ship, which prints our shipping labels; we removed the Cloudflare page counter, whose only page (the $5 reservation page) has been retired; we said plainly that our Claude account is a consumer plan whose training use we can't switch off, and what we do about that; and we've set out what an order placed without an account stores.
Updated September 8, 2026: we no longer ask for your date of birth. You confirm you're 18 or older by ticking a box at checkout, which our payment processor records with your order. Dates of birth given at sign-up before this date are kept as described below. Shop orders and the Opening Statement no longer need an account, and we don't create one for you; your email address goes on the order for its confirmation and tracking. We no longer send sign-in links by email. Added Anthropic to the services we use.
Updated August 21, 2026: we've broadened what your date of birth may be used for. Alongside the 18+ check, we may use it to send you a birthday perk and to understand the age range of our customers. We still don't sell it and don't use it for advertising targeting, and we still only ask for it once.
Updated August 20, 2026: you can now ask us to carry a brand we don't stock. Added that request to “What we collect”. Your email is collected only if you tick the box asking to be told (unticked, no address reaches us), and it is used for that one message, never added to marketing.
Updated August 7, 2026: our phone line is answered by an AI assistant that identifies itself, and calls are recorded: we keep the audio and a transcript. Added voice recordings to “What we collect”, described how long they are kept, and noted that you can email instead if you'd rather not be recorded. (This update also carries the August 4 change that named Quo as our phone provider, which was published without moving the effective date.)
Updated August 2, 2026: Period+ now offers optional measurement through Meta and Google Analytics, which load only if you agree to them. Rewrote “Cookies, analytics and advertising” in full, added Meta to “Who we share it with”, and set out exactly what is and is not sent. Also named Microsoft 365, which has always held our hello@ mailbox.
Updated July 29, 2026: added date of birth and password to “What we collect”, and explained how the 18+ check works.
We sell period products. That means the fact that you're our customer is, itself, personal, and we treat it that way. This policy explains exactly what we collect, why, who we share it with, and how to get it deleted.
The short version
- We never see your card number. Stripe handles payment; we only get the last four digits and expiry.
- On this website, nothing that tracks you loads unless you say yes. Our measurement and advertising tools don't load at all without your agreement, and the site works exactly the same if you say no. Our web host does keep a plain count of visits for everyone, with nothing added to your browser, and we keep our own anonymous tallies of how people find our site, how many boxes get built, and, if you choose to tell us, what stopped you subscribing (what they count). Our emails are different: they tell us whether they were opened and which links were clicked (how, and how to avoid it).
- We never share what you bought. If you do say yes, Facebook is told a purchase happened and what it cost. It is never told which products were in your order.
- Nothing on the outside of your box says what's inside it.
- Ask and we'll delete you. One email.
What we collect
| What | Why we need it |
|---|---|
| Email address | Order confirmations, shipping and tracking updates, and (if you have an account) your sign-in identity and password-reset links. For each email we send, we also learn whether it was opened and which links in it were clicked (see below) |
| Date of birth | Not collected since September 8, 2026. Accounts created before then gave us a date of birth once, at sign-up, to confirm 18+; we keep those, and may use them to send a birthday perk and to understand the age range of our customers. New customers confirm they're 18 or older at checkout instead, and no date is asked for. We do not sell it, and we do not use it for advertising targeting. See Children for how the 18+ check works. |
| 18+ and terms confirmation | At checkout you tick a box confirming you're 18 or older and accept our terms. Our payment processor (Stripe) records that you did, with the order. If you have an account, we also keep the date of your first confirmation on it. |
| Password | Only if you set one. We never see it: our sign-in provider stores a one-way encrypted version, which cannot be turned back into your password. That's also why we can only ever reset it, never tell you what it is. |
| Name | To address you, and for shipping |
| Shipping address | To send your order, and to print the label |
| Phone number (optional) | Only if you give it, for delivery problems |
| Which products you choose | To pack the right box, and to know how much to order |
| Box name | If you subscribe, each of your boxes has a name so you can tell them apart. We start them as “Box 1”, “Box 2” and so on, and you can change a name to anything you like, up to 24 characters. It shows on your account page and on our own packing list, so we pack the right box, and if you have more than one box it appears in the body of your order and account emails (never the subject line). If you name a box after the person it's for, that may be a family member's first name: we don't ask for it and don't need it, and we treat it as part of your account information, kept and deleted the same way. It is never sent to Meta, Google or any other advertising platform. To change it, use Edit next to the box's name on your account page while the box is active. A box always has a name, so if you'd rather it said nothing about anyone, change it back to “Box 1”. Once a box has ended, email us and we'll change it for you. |
| Life stage (optional) | Only if you tell us, so we can suggest products that fit |
| ZIP code | The shop cart asks for one so we can quote you the real USPS postage for where you are, before you pay; we don't store that one. Separately, if you joined our waitlist we kept the ZIP you gave there, to understand where our customers are and plan shipping |
| Order and shipment history | Support, returns, and your own records |
| Reviews and messages you send us | To publish (reviews, with your permission) and to reply |
| Voice recordings and transcripts of calls | Only if you call us. Our line is answered by an automated assistant that says so and tells you the call is recorded. We keep the audio and a transcript so we can hear what you needed and get back to you. Don't want to be recorded? Email hello@periodplus.us instead. |
| A brand or product you ask us to carry | Only if you use our request form. We keep the brand, the type of product, anything else you tell us, and what you'd filtered to when you asked, so we know what to buy next. Your email is only kept if you tick the box asking us to let you know, and then we use it for that one message and nothing else; we won't add you to our mailing list. Leave the box unticked and we never receive an address at all. |
| Your email, if you ask to hear when the Opening Statement is ready | Only if you give it to us for that. We keep your email address and the date you asked, and nothing else; we don't ask anything about the person it's for. We use it for one email, when the Opening Statement can be ordered, and for nothing else: we won't add you to our mailing list, and we never give it or upload it to Meta, Google or any other advertising platform. Like every email from us, that one tells us whether it was opened and which links in it were clicked (see below). Changed your mind before then? Email hello@periodplus.us and we'll delete it. |
| A quote request from an organization | Only if you use our organizations form. We keep the organization's name and kind, your name, your email address, your phone number if you give it, roughly how many people, what you need and how often, the city, state and ZIP it would go to, anything you write in the notes box, and your answers on sales tax and resale. We use it to reply with a quote and, if you order, to fill the order. We don't add you to a mailing list. If it never becomes an order, we delete the record in our system 12 months after the last activity on it; if you order, the record stays with the order. Copies in our mailbox are kept as described under “How long we keep it”. |
| Names and delivery addresses your employer gives us for staff boxes | Only if an organization orders boxes delivered to its people's homes. The organization supplies each name and address and is responsible for having its people's agreement to share them. We use them only to pack and ship those boxes, and we delete them when the organization's order ends. |
| People who work with us on posts, and giveaway winners | Only if you agree to post about us or you win one of our giveaways. We keep your name, your public social media handle, the message thread or email address we talk to you through, and the delivery address for anything we send you. If we pay you for a post, we may also need a tax form from you, which includes your tax identification number. We use these only to arrange the post or the prize, send it to you, and pay you if we've agreed to. We don't add you to any mailing list, and none of it goes to an advertising platform. Your name and address go to Pirate Ship so a label can be printed; our messages stay on the platform you wrote to us on, or in our mailbox; a payment goes through our bank or Stripe; and we report a payment to the tax authorities where tax rules require it. We delete your address, and our messages about arranging the post or prize, 12 months after we last worked together or your prize was delivered, apart from the shipping record Pirate Ship may keep under its own privacy policy. We keep your name, your handle, a record of what we agreed and sent, and any record of a payment, including the tax form, as long as tax and accounting rules require. |
| Card details | We don't collect these. Stripe does. We see only the last four digits and expiry date. |
If you order without an account (anything from our shop), we don't create one for you and you don't get one by accident. What we keep is the order: your email address, your name, your delivery address, what you bought and what you paid. The email address is where your confirmation and tracking go, and it's how we find your order if you write to us. If you later open an account with that same email address, those earlier orders are attached to it so they show up in your own order history. That happens once, when the address is confirmed as yours.
How we use it
To send you the orders you paid for, bill you correctly, answer you when you write, keep your account working, and plan how much product to buy. That's it.
We also use aggregated, de-identified information (like "60% of packs chosen this month were pads") to decide what to stock. That kind of analysis never identifies you.
Marketing email. If you're a customer or joined our waitlist, we may email you about Period+. Every one of those has an unsubscribe link, and unsubscribing never affects the emails you actually need: order confirmations, shipping notices, and billing. Asking us to email you when the Opening Statement is ready is different: it gets you that one email and nothing else, and it doesn't put you on our waitlist or our mailing list.
Who we share it with
We don't sell, rent, or trade your personal information. We share it only with the services that make Period+ work, and only what each one needs:
| Service | What it handles |
|---|---|
| Stripe | Payments, cards, subscriptions, receipts, the billing portal |
| Supabase | Our database: your account, preferences, and order records |
| Netlify | Website hosting, and counting visits to the website (which pages are shown, roughly how many different visitors, where they came from and roughly where they are), worked out from the requests your browser sends to load each page, including your IP address. We see totals, not individual visitors |
| Resend | Sending our email (order, shipping and account emails, and marketing email), and recording for us whether each email was opened and which links in it were clicked |
| Anthropic (Claude) | We build and maintain this site with Anthropic's Claude AI tools. Nothing on the site sends anything to them on its own; it happens only when we use Claude for admin work, such as checking an order, fixing a problem or updating our records, and it can then read what our database holds. Our Claude account is a consumer plan, and Anthropic may use what Claude sees to improve its models. Because of that we keep your details (names, box names, email and shipping addresses) out of it unless a specific task can't be done without them, we never send it your card details (we never have those), and we don't use it to make decisions about you. Anthropic processes what it does see under its own privacy policy. |
| Microsoft 365 | Our hello@ mailbox: anything you email us, and our replies, are stored there |
| Google (Gmail) | Receives the quote requests sent through our organizations form, and the replies to them, in the mailbox of the person who answers them |
| Quo | Our phone line. Calls are answered by an automated assistant that tells you at the start that it's an AI and that the call is being recorded. We keep the audio recording as well as a written transcript, so whatever you say on the phone is stored there too. Quo also shares recordings with its own service providers, and processes and stores them under its own privacy policy. |
| Meta (only if you agree) | Advertising measurement: that a visit or a purchase happened, and the amount. Never which products. Nothing loads unless you opt in |
| Google Analytics (only if you agree) | Which pages people look at, in what order, and on what kind of device. “Google signals” is switched off and Google Ads is not connected, so it isn't combined with what you do elsewhere. Nothing loads unless you opt in |
| Pirate Ship, and the carrier that delivers | Your name and delivery address, so a label can be printed and the parcel carried to you. We buy every shipping label through Pirate Ship, which is given that name and address; the parcel is then carried by USPS or, occasionally, another carrier Pirate Ship offers for that shipment |
We may also disclose information if the law requires it, or to protect someone's safety or our legal rights. If Period+ is ever sold or merged, customer information could transfer as part of that, and we'd tell you before it did.
Cookies, analytics and advertising
On this website, nothing that tracks you loads until you agree
We ask once, in a banner at the bottom of the page. Until you answer, and forever if you answer no, the advertising tools below are never loaded: not blocked after the fact, not loaded at all. Signing in, building a box and checking out work identically either way. You can change your mind whenever you like using Your privacy choices at the bottom of any page.Always on
A tally of how people find us. When you arrive on our homepage or one of our shop pages from somewhere outside this site, we add a single line to a tally we keep ourselves: where the visit came from, which page it reached, the hour it happened, and the country and state the request came from. Where it came from is either the campaign label on one of our own tagged links or, for any other visit, only the broad kind of site that sent you: Facebook, Instagram, Google, Bing, another website, or no website at all. Apart from our own campaign label, we never keep the address of the page you came from or anything after the page name in our web address. That line holds nothing about you: no name, no email address, no IP address, no cookie, no device or browser details, no town, and nothing tying it to any other visit or to an order. Moving between pages on our site adds nothing. It works the same whether or not you agree to the banner, because there is nothing in it to agree to. We don't share it with Meta, Google or any other advertising platform, and we delete the lines after 24 months.
A count on the build page. Our Build a box page adds a one-line count at a few moments: when you fill a box, when you tap Subscribe, and if the subscribe step then fails. Each line holds only which of those moments it was, the plan, which offer the page was showing (if any), our own campaign label, an error code if something failed, how many items were in the box when you tapped Subscribe, and the hour. It holds nothing about you or which products you picked: no name, no email address, no IP address, no cookie, no device or browser details, and no code or number that ties one line to another, to any other visit or to an order. It works the same whether or not you agree to the banner. We don't share it with Meta, Google or any other advertising platform, and we delete the lines after 24 months.
A question on the build page. If you start building a box and leave without subscribing, the page may ask you one question: what stopped you. You don't have to answer. If you tap an answer, we keep only that answer, the plan and which offer the page was showing (if any), our own campaign label, and the hour. It holds nothing about you: no name, no email address, no IP address, no cookie, no device or browser details, and no code or number that ties it to the count above, to any other visit or to an order. So that it only asks once, the page notes in your browser that it has asked; that note stays in your browser, holds nothing else, and disappears when you close the tab. It works the same whether or not you agree to the banner. We don't share your answer with Meta, Google or any other advertising platform, and we delete the answers after 24 months.
Signing in stores a small amount of data in your browser so you stay logged in; that's necessary for the site to work, and it disappears when you sign out. Your shop cart lives in your own browser; we only receive what's in it when you ask for a shipping quote or go to checkout. Neither of these follows you to other websites, and neither requires your permission. Your answer to the banner is remembered in your browser so we don't ask on every page; if your browser won't allow that, we keep it in a small cookie of our own for a year instead. It holds only your choice.
A count of visits, kept by our web host. To load any page, your browser has to ask our host, Netlify, for it, and that request includes your IP address and usually the website that sent you. Netlify turns those requests into totals for us: how many times each page was shown, roughly how many different visitors came, which websites sent them, and roughly where in the world they were. Nothing is added to the page, nothing is stored in your browser, and it works the same whether or not you agree to the banner, because it only counts requests the site already has to answer. We see the totals, not a list of visitors, and we don't try to work out who anyone is from them. We don't share these totals with Meta, Google or any other advertising platform.
Which of our links brought you here. Links we make and label, like our ads, some of our posts, and links we give to people who post about us, carry a label saying where they were posted and which campaign they belong to (for example “facebook” and “store open”). If you arrive through one, your browser keeps that label for up to 30 days, and if you place an order we save it with the order. The label describes our link, never you. It isn't sent to any advertising platform, and it isn't used to follow you around the web. A link with no label leaves no label behind with us; it appears only in the tally above, as the broad kind of site it came from.
In our emails
The emails we send you, including order confirmations, shipping notices, account and password emails, and marketing email, contain a tiny invisible image, and their links pass through our email provider, Resend, on the way to where they point. That tells us whether an email was opened and which links in it were clicked, and when. We use it to know whether our emails are arriving and which ones are actually useful. It isn't sent to any advertising platform, and it doesn't follow you around the web.
Because this happens inside the email rather than on our website, there is no banner to ask you first. Here is how to avoid it: turn off automatic image loading in your email app and opens won't be recorded, and to keep a click from being recorded, type periodplus.us into your browser instead of tapping the link. You can stop marketing emails at any time with the unsubscribe link in each one; order and account emails still arrive.
Only if you say yes
The Meta pixel (Facebook and Instagram) and Google Analytics. Almost everyone finds Period+ through a Facebook group, and without these we genuinely cannot tell which posts bring people here and which are shouting into the void.
If you agree, they set cookies and record that a device visited our pages, and, if you buy something, that a purchase happened and the amount. Meta may connect that to your Facebook account.
Google Analytics tells us how people move around the site: which pages, in what order, and on what kind of device. It is not told what you type into our product search, which filters you choose, or which order you placed. We use it to fix what's confusing and to stock what people are actually looking for. We have deliberately switched off "Google signals," the setting that would let Google combine this with what you do on other websites, and we have not connected Google Ads to it.
What it is never told:
- Which products you chose. We deliberately don't send product names or codes. What absorbency you use is nobody's business but yours, and our systems are built so that information cannot reach an advertising platform even by mistake.
- Anything you type into our forms. We switched off the setting that would have scraped your name, email address and shipping address out of them. (We stopped asking for a date of birth altogether on September 8, 2026.)
- Anything at all from your account pages. The pixel doesn't run there.
We don't retarget you with ads for products you looked at.
About "selling" your information
We don't sell your personal information for money, and we never will. You should know that some US state privacy laws define "selling" or "sharing" broadly enough to include sending data to an advertising platform like Meta, so if you'd rather that didn't happen, decline the banner, or use Your privacy choices to withdraw. We'll honour it, and nothing about your account or your boxes changes.
Your privacy on the outside of the box
Your box is plain on the outside apart from our name and logo. Nothing on the exterior describes the contents. Our name doesn't appear on your card statement as anything more revealing than the business name.
Children
Period+ accounts are for adults. You must be 18 or older to create an account or buy from us. We do not knowingly collect personal information from children under 13.
Some of our products, like a first-period kit, are intended for a young person but purchased by an adult. In that case the account, the email address, and the information we hold all belong to the adult purchaser. We don't ask for information about the young person who'll use the products, and we don't need any. If you believe a child has given us personal information, email us and we'll delete it.
Naming a box after someone. If you give one of your boxes the name of the person it's for, that name is information you've chosen to give us about your own household. It belongs to your account, is protected and deleted the same way as the rest of it, and is never sent to an advertising platform. We never ask for that person's age, school or anything else about them, and we never open an account for them. “Box 2” works just as well.
How we check. Before taking your payment, checkout asks you to confirm that you're 18 or older and accept our terms; the order can't be placed without it, and the confirmation is recorded with the order. We're relying on what you tell us; we don't verify it against an ID, because asking for identity documents to buy period care would be out of all proportion. If you gave us a date of birth before September 8, 2026, it's stored once and can't be edited from your account; if it's wrong, email us and we'll correct it.
How long we keep it
We keep your account and order information, including orders placed without an account, while you're a customer, and afterwards only as long as we need it: for warranty and support questions, and to meet tax and accounting rules, which generally means several years for records of what was sold. When we no longer need it, we delete it or strip out anything identifying.
Call recordings and transcripts are held by our phone provider for as long as our account with them is open, and are processed and stored under their own privacy policy. We delete them when we no longer need them.
Brand requests we keep while we're still deciding what to stock. If you gave us an email so we could tell you, we delete the address once we've told you, or once it's clear we won't be carrying it. The request itself stays, without your address, because a count of what people asked for is what we plan around.
“Tell me when it's ready” sign-ups for the Opening Statement we keep until we've sent that one email, and we delete your address within 30 days after sending it, so we can still act on it if you reply asking us to stop. If we decide not to go ahead with the Opening Statement, we delete every address without emailing anyone, and if it still can't be ordered 12 months after you signed up, we delete yours anyway. If you ask us to stop emailing you, we keep your address only on a do-not-email list, so that we don't email you again.
Organization quote requests that never become an order we delete from our system 12 months after the last activity on them. If the organization orders, the record stays with the order. The emails about a request stay in the mailbox of the person who answered it, like any email you send us.
Details of people who work with us on posts, and of giveaway winners, are kept for as long as their row under “What we collect” says.
Box names stay with the box, including after it ends, so your order history still makes sense. While a box is active you can change its name on your account page; once it has ended, email us and we'll change it to a plain number. If you ask us to delete your information, box names go too: they aren't part of the records tax and accounting rules require us to keep.
Your choices and rights
Whatever state you're in, you can ask us to:
- Show you what personal information we hold about you
- Correct anything that's wrong
- Delete your information (we'll keep only what tax or accounting law requires)
- Stop marketing emails: unsubscribe, or just tell us
Email hello@periodplus.us and we'll take care of it. We won't treat you differently for asking, and we don't charge for it. Depending on where you live, you may have additional rights under your state's privacy law, including the right not to have your data sold, which is easy for us to honor because we don't sell it.
Security
Your account data sits behind per-user access rules, so one customer's account can't reach another's. Card data never touches our systems; Stripe holds it. Our site is served over HTTPS.
No system is perfectly secure, and we won't pretend otherwise. If a breach ever affects your information, we'll tell you promptly and plainly.
Changes to this policy
If we change this policy in a way that matters, we'll email active subscribers and update the effective date at the top. We won't quietly broaden what we do with your information.
Contact
Email hello@periodplus.us, call 334-429-6078, or write to Period Plus, LLC, Enterprise, Alabama. We're a small family business; a real person reads what you send.
If you call us, an automated assistant answers and tells you at the start that it's an AI and that the call is being recorded. We keep the recording and a written transcript. A real person reads it and gets back to you; nobody is listening live. If you'd rather not be recorded, email us at hello@periodplus.us instead and we'll pick it up there.
Make Your Statement.
Period Plus, LLC · Enterprise, Alabama · © 2026 · Terms of Service