Privacy

Who we are

Merchant of Oz is an independent pre-loved clothing shop in Northwest Arkansas. We do not open a storefront. This site is the door. Our mailing address, 1460 Abbey Ln, Centerton, AR 72719, appears in the footer of our emails.

What we collect

If you sign in with Google, Firebase Auth stores your account email, display name, photo URL, and a user id. We use that to know who you are.

Favorites can sit in your browser and, when you are signed in, in Firestore under your user id.

Staff who place an invoice order give a bill-to and ship-to name, street, city, region, and postal code. Those fields live on the order record.

Staff notes in the hat inbox stay on that staff account.

If you join the mailing list, we store your email for notes from the shop. We mail you a link first and add you only once you tap it. Every message has a one-tap link to leave, and you can also write to support@merchantofoz.com. Staff write newsletter drafts here.

If you answer the Curiosity Finder, the antique booth survey, your answers save as you go, so a survey left half way still counts: what you picked, your wish list, an email only if you give one, how far you got, and when. No sign-in is needed. If you sign in at the end, we link the answers to your account. Only staff can read them. Ticking the updates box sends you the same confirm link as the mailing list. To have a response removed, write to support@merchantofoz.com.

If you turn on email notifications in Settings, we store your choices under your user id: saved pieces, new arrivals, orders, notes, and when you last pressed Unsubscribe from all. We keep a record of what we sent you so nothing goes out twice.

Staff actions on grants, invoices, floor counts, ledger snapshots, and social placeholders write an append-only audit entry (who, when, what). Shopper addresses stay on the order, not in that log.

The browser may keep a short session hint so the shop does not flash the Coming soon screen on an in-site click.

The hang stores anonymous product-page view counts and which control was clicked next (save, bag, a tag, another piece, and similar). Those counts have no name, email, or user id.

Google Analytics records page path, referrer, device, and approximate location. We do not send your email or user id to Analytics. It sets cookies to count visits. A notice at the bottom of the page asks once, and Settings lets you change your answer. If you say no, nothing is sent.

Who sees it

Google provides sign-in, hosts Firebase Auth and Firestore, and runs Google Analytics. Amazon Web Services sends our email through Amazon SES, so it handles your address and the message to deliver it. We do not sell personal information.

Staff who open the books can read save counts, invoices, floor numbers, and ledger snapshots stored in Firestore. Staff can edit social account placeholders and the mailing list. Staff can read hang view and next-click counts. Staff can read the audit log. Page sessions and location stay in Google Analytics; this site does not pull those.

We do not run an ad pixel or remarketing. Product photos and this policy are public.

How long we keep it

Account and favorite data last while the account is used. Order records last as long as we need them to fulfill or prove a sale. Mailing-list addresses last until you leave or we close the list. Notification choices and send records last while the account is used. Hang view counts and audit entries last while we run the shop. You can delete your data, or your whole account, yourself: Settings, then Account. Deleting removes your saved pieces, email choices and sign-in, and takes your address off the mailing list. You can also download a copy of your data there first.

Children

This shop is not directed at children under 13. We do not knowingly collect their data.

Changes

We will post updates on this page. Last updated 2026-10-08.