What we collect, what we don't.
Last updated · October 29, 2026
On this page16 sections
The short version
We collect the minimum needed to ship you a bottle and let you sign in. We do not sell your data. First-party analytics in your browser runs unless you reject it in our cookie banner, and you can change your mind at any time from the Cookie preferences link in the footer. Order records are kept server-side either way; we need them to ship your order. Refill reminders are free, no subscription.
Information we collect
You give us
- Account info: your email address, when you make an account with a password, sign in with Shop on the website or sign in with Apple in the app.
- Shipping address and order contents when you check out.
- Quiz answers (scent, wash or lotion or bar, when you use it, and whether it is for you or a gift) when you take the four-question quiz.
We observe
- Which scents you have browsed, tried, and owned, so your Scent Atlas reflects your actual usage.
- Time spent on each product page. We record how long you spend reading a product page and whether you scroll through it, so we can mark that scent as browsed on your Scent Atlas. We call this dwell time. Browsing earns no MCO Credit; Atlas credit comes from a paid order. It is tied to your account if you are signed in, or to a random session ID stored in your browser if you are not.
- Aggregate page traffic, unless you reject the cookie banner. This helps us see which pages help and keeps the site fast. Reject stops it immediately and keeps it off on every later visit.
The iPhone app
The Motor City Organics app for iPhone uses the same account as the website. The app collects:
- Your account: your email address and account ID when you sign in with email and password or with Apple. If Apple shares your first name, it stays on your phone for the greeting. Signed out, a random ID keeps your cart and Scent Atlas. A paid order is recorded in our analytics with its email address, as on the website, and a first order starts our welcome emails.
- Your orders, refills and cart, to show your orders and line up your refills.
- What you type at checkout. The checkout inside the app is Shopify's, the same one the website uses, so your name, shipping address, phone number and payment go to that checkout to fill the order; we never see card numbers. Shopify reports checkout starts and completed orders to Meta, and can match them to the email address, phone number, name or shipping address on the order, under its own settings, as it does on the website. In the app, Shopify's Meta pixel loads on that checkout only after you allow tracking (below).
- A notification token, only after you turn notifications on, so we can send your refill and order notes. Apple delivers them.
- App analytics, sent through our own domain to our analytics provider: an install ID the app makes; the products you view, what you add to your cart, when you open the cart and come back from checkout; when the app is installed, updated, opened and put in the background; and details of your phone and the app, such as your device model, iOS version, app version and build, language, time zone, screen size and whether you are on Wi-Fi or cellular. Our analytics provider also stores the network (IP) address each event comes from. We turn off looking up a location from it. When you start checkout, the install ID and the app session go with it, and our server records the start of the checkout with them, so a started checkout and a paid order join your app activity.
- Time spent on a product page, to mark that scent browsed on your Scent Atlas, as on the website.
Tracking in the app: right before your first checkout, your iPhone asks whether Motor City Organics may track you (Apple's App Tracking Transparency). Choose Allow and Shopify's checkout may report that order to Meta, as described above. Choose Ask App Not to Track and every checkout the app opens tells Shopify that marketing and sharing your data are off, so Shopify's Meta pixel does not load on it. You can change your answer any time in your iPhone's Settings, under Privacy and Security, then Tracking. Your cookie choices on the website do not apply to the app.
The app does not collect your location, contacts, photos, health data or search history, and does not use your device's advertising identifier. You can turn notifications off in your iPhone's Settings, and delete your account from the Account tab.
The Scent Atlas program
Your Scent Atlas is a personal shelf of all 10 MCO scents and the MCO Credit you have earned by buying them. We store the state of each tile (locked, browsed, tried, owned) and your running MCO Credit balance against your account. A tile is marked browsed when you spend enough time on that scent's product page, which earns no credit, and lights when you purchase any product in that scent. If you are not signed in, your tile state is stored against the random session ID in your browser, and shows on your account when you sign in from that browser.
Quiz sessions
When you take the find-your-three quiz, we save your answers so you can come back and finish later. If you are signed in, your answers are saved to your account in Supabase. If you are not signed in, they are saved in your browser using localStorage. Local quiz data stays in your browser until you clear it; it is not sent anywhere unless you submit the quiz.
Dispatch announcements
We may show you in-app banners on the site, small promo slots in your cart, and (only if you have subscribed) emails about new scents, restocks, and limited promotions. We call this the Dispatch. You can ignore the in-app banners, and you can unsubscribe from Dispatch emails at any time via the link in every email.
Promo codes
We track when a promo code or a credit is applied to your cart (including offers we apply automatically and welcome table credit), whether it succeeded, and whether you completed a qualifying order with it. We use that only to enforce one-per-customer and minimum-order rules. We do not share promo-code usage with third parties.
When you enter an email for 10 percent off a first order, we look up whether that email has already placed an order with us, in our own records and our store's order system, and use the answer only to decide whether the offer applies.
How we use it
- Sign you in and keep you signed in.
- Fulfill orders and email shipping confirmations.
- Show you the right state of your Scent Atlas and MCO Credit balance.
- Send refill reminders for items you have purchased. Opt out at any time.
How we don't use it
- We do not sell or rent your data to third parties.
- In the US, a Meta advertising pixel runs by default and tells Meta which products you view and add to your cart, so we can measure and show our ads. Reject or Analytics only turns it off on the spot and keeps it off, and so does a Global Privacy Control signal from your browser. Outside the US, or when we cannot tell where you are, the pixel loads only after you accept the cookie banner. First-party browser analytics runs unless you reject the banner, and Reject shuts it off on the spot. Checkout runs on Shopify, which reports checkout starts and completed orders to Meta under its own settings; a choice made in our cookie banner does not reach the Shopify checkout page. When you arrive from an ad or a search listing, the link's campaign tags (utm values and click ids such as Meta's fbclid or Google's gclid) and the site that sent you are kept in your browser for 30 days and sent with your checkout so we know which ad or listing led to the order, unless you press Reject, which deletes them. While the Meta pixel is on, Meta's own browser and click cookies (_fbp and _fbc) are sent with your checkout too; Reject or Analytics only stops that. Checkout and order events are recorded server-side for store operations regardless of your cookie choice; Reject keeps them unlinked from your browsing. Google Ads and TikTok pixels are not used.
- We do not use your quiz answers for anything other than your starting three.
Ad matching with Meta
When the Meta pixel runs, it also sends Meta your email address and phone number in hashed form, once you have given them to us: your email at the welcome table, in "Email me if I leave this cart", or by signing in, and your phone number at the welcome table. Each is turned into a SHA-256 hash in your browser before it leaves, so Meta receives the hash, never the address or the number. Meta uses it to match your visit to a Meta account, so we can measure which ads lead to a sale and show our ads to people more likely to want them. It follows the pixel: on by default in the US, and only after you accept outside the US or when we cannot tell where you are. Your browser keeps the hashes only while the pixel is allowed to run: outside the US, or when we cannot tell where you are, nothing is kept until you accept. Reject or Analytics only turns it off and deletes them, and so does a Global Privacy Control signal from your browser, even after you accept.
Third-party processors
Five companies help us run the store: Cloudflare hosts the site, Supabase stores accounts, Resend sends email, Shopify runs the checkout and processes the orders, and PayPal takes payment when you choose PayPal or Venmo at checkout. Shopify takes every other payment, including cards, Shop Pay and Google Pay, and we never see card numbers. Each one is contracted to only do what we ask with your data. Our analytics provider processes browser analytics unless you reject the cookie banner, plus server-side order and checkout records we keep for store operations. A Meta advertising pixel runs by default for US visitors and only after you accept everywhere else. Reject stops the browser analytics and the pixel; the operational order records remain.
Cookies
Strictly necessary cookies are always on: a session cookie when you sign in, a preference cookie if you toggle motion-reduced mode, the cookie that remembers your choice below, and one that remembers your country for a day so the right default applies. Shopify's checkout, and the PayPal and wallet buttons on it, can set their own cookies while you check out. The first-party analytics cookie runs unless you reject our cookie banner; rejecting stops it immediately and keeps it off. A Meta advertising pixel loads by default for US visitors, and only after you accept everywhere else; Reject or Analytics only turns it off. You can change your choice at any time from the Cookie preferences link in the footer.
Your controls
- Export or delete your data at any time. Email support@motorcityorganics.com, or delete your account yourself from your account page on the website or the Account tab in the app.
- Unsubscribe from refill reminders via the link in every email.
- Sign in with Apple users can use Apple's private-relay email; it works the same as any address.
Children
Motor City Organics is not directed to children under 13 and we do not knowingly collect data from them.
Changes
If we change this policy materially, we will post the new version here and update the "Last updated" date. For changes that affect existing accounts we will also email you.
Contact
Motor City Organics. Detroit, MI. support@motorcityorganics.com.