How we handle your data.

This Privacy Policy explains how her.hockey ("we," "us," or "our") collects, uses, shares, and protects information when you visit her.hockey or use the fit-guidance tools, newsletter, and feedback features on the site. her.hockey is operated as an independent editorial property; we are not a retailer.

By using the site you agree to this Policy. If you do not agree, do not use the site. The plain-language summary above is operative and controls in case of conflict with anything below.

A. Information you provide

• Newsletter signup: email address.
• Fit-feedback widget: rating (yes / partial / no), optional comment, optional email, and a snapshot of the fit-result you are commenting on (selected skate, size, width, fit score, your inferred foot profile).
• Direct correspondence: if you email us, we keep the email and any attachments to respond.
• User-submitted photos: if you submit photos for editorial use, we keep them and credit metadata.

B. Information stored only in your browser

Your fit-quiz answers (shoe size, foot complaints, position, skill, optional measurements, equipment selections, results history) are stored in your browser's localStorage under the keys herhockey:lastFit and related namespaced keys. We never receive these values on our servers. Clearing your browser storage deletes them.

C. Information collected automatically

• Cloudflare Web Analytics: aggregate page views, referrers, country, device type. Cookieless and privacy-preserving — does not fingerprint, does not set cross-site cookies, does not track individuals.
• Server logs (Cloudflare Pages Functions): when you submit the newsletter or feedback form, the request is logged with timestamp, IP address, country (from CF-IPCountry), and user agent. Used for abuse prevention and debugging. Retained ≤ 30 days.

D. Information from third parties

We do not buy mailing lists, demographic profiles, or behavioral data about you from third parties.

• To send you the her.hockey dispatch (newsletter) if you opted in.
• To investigate fit-feedback misses, improve the algorithm, and follow up with you when you provide an email and ask us to.
• To respond to your direct emails and inquiries.
• To detect, investigate, and block abuse (spam, scraping, automated form submissions).
• To produce aggregate, non-identifying analytics that help us understand which content is read.
• To comply with legal obligations and enforce our Terms.

We do not use your information to train third-party AI models. We do not sell your information.

We share information only with the service providers listed below, and only to the extent necessary to operate the site.

• Resend (resend.com): stores newsletter subscribers and sends transactional + broadcast email on our behalf. Email addresses and email content are processed by Resend. See Resend's privacy policy.
• Cloudflare: hosts the site (Cloudflare Pages), runs the request handlers (Pages Functions), and provides cookieless analytics. See Cloudflare's privacy policy.
• Skimlinks: rewrites outbound retailer links and attributes any resulting commission. Loaded from s.skimresources.com on every page. May set cookies on the destination retailer site after click-through. See Skimlinks' privacy policy.
• Amazon Associates: when you click an Amazon link tagged herhockey-20 and complete a purchase, Amazon attributes the commission to us. Amazon's own cookies are governed by their privacy policy.
• Legal compliance: we may disclose information if required by valid legal process (subpoena, court order) or to protect rights, safety, or property.
• Business transfer: if her.hockey is acquired or merged, your information may transfer to the successor, which will be bound by this Policy or notify you of any material changes.

her.hockey itself does not set tracking cookies. We use localStorage to remember your fit-quiz progress in your browser and sessionStorage for in-session UI state.

Third-party scripts that may set cookies in your browser:

• Skimlinks sets a session cookie when you click an outbound retailer link in order to attribute the click.
• Cloudflare may set a security cookie (__cf_bm) for bot mitigation. This is functional, not advertising.

We do not use Google Analytics, Meta Pixel, TikTok Pixel, X / Twitter Pixel, or any retargeting / advertising pixel.

A. Universal rights (granted to all users regardless of location)

• Access: request a copy of any personal information we hold about you.
• Deletion: request deletion of your information from our newsletter audience and feedback records.
• Correction: request correction of inaccurate information.
• Opt-out: unsubscribe from the newsletter at any time using the link in every email.

To exercise any of these, email [email protected] with the subject line DELETE MY DATA / ACCESS MY DATA / etc., from the email address you used to interact with the site. We will respond within 30 days.

B. California residents (CCPA / CPRA)

In the past 12 months we have collected the categories of personal information described in Section 2: identifiers (email), internet activity (page views, referrers), and inference data (your fit-result snapshot when you submit feedback). We have not sold or shared your personal information for cross-context behavioral advertising. You have the right to know, the right to delete, the right to correct, and the right not to be discriminated against for exercising any of these rights.

C. EU / UK / EEA residents (GDPR / UK GDPR)

Our legal bases for processing are: (i) consent (newsletter signup, fit-feedback submission); (ii) legitimate interest (security logging, abuse prevention, aggregate analytics); (iii) legal obligation (responding to lawful requests). You have the right to access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time. You also have the right to lodge a complaint with your supervisory authority.

Data Controller: her.hockey (independent operator). Contact [email protected] for all data-rights requests. We do not currently have a designated EU representative; for trans-Atlantic users we rely on Standard Contractual Clauses through our processors (Resend, Cloudflare).

her.hockey is intended for adults purchasing or researching skates. We do not knowingly collect personal information from children under 13. The fit-guide's "youth path" uses only generic age tier and skill level inputs that the parent or guardian fills in on the child's behalf — no child-identifying information is requested or stored on our servers.

If you are a parent or guardian and believe a child under 13 has provided us with personal information (e.g. through the newsletter signup), email [email protected] and we will delete it promptly.

• Newsletter audience: retained until you unsubscribe or request deletion.
• Fit-feedback emails: retained as long as the inbox archive exists, used to investigate fit accuracy and pattern-match recurring issues.
• Cloudflare Pages Function logs: retained per Cloudflare's default (typically ≤ 30 days).
• Analytics aggregates: retained indefinitely as non-identifying counts.

All site traffic is served over HTTPS with TLS. API keys for Resend and other services are stored as encrypted environment variables in Cloudflare Pages and are never exposed client-side. We follow standard practices to protect against unauthorized access, but no system is 100% secure. If we become aware of a breach affecting your information, we will notify you and any required regulator without undue delay.

Our processors (Resend, Cloudflare) may store and process information in the United States and other jurisdictions. Where required by law, transfers from the EEA / UK rely on Standard Contractual Clauses or equivalent safeguards through those processors.

Outbound retailer and reference links open third-party websites with their own privacy practices. We have no control over what those sites do once you arrive. Read their policies.

We may update this Policy. The effective date in the header reflects the most recent change. Material changes (new categories of data collected, new recipients, new processing purposes) will be flagged with a banner on the site for at least 14 days before they take effect. Continuing to use the site after the effective date means you accept the updated Policy.

Privacy questions, data-rights requests, COPPA notifications, and security reports: [email protected].

EFFECTIVE · 2026-04-30 · OWNER · HER.HOCKEY (INDEPENDENT)