Privacy policy

Last updated: September 13, 2026

Who is responsible

This notice describes how Hi Anxiety T-Shirt Co. (the “operator”, “we”, “us”) handles personal information through this website. The site is hosted in Canada. The operator’s stated location is Alberta, Canada. This notice covers this website; independent websites linked from it have their own privacy practices.

For privacy questions, access or correction requests, deletion requests, complaints, or accessibility assistance, email btherio99@proton.me. Please describe your request without sending passwords or unnecessary sensitive information. Identity verification may be necessary before account information is disclosed or changed.

Information handled by the website

• Accounts: username, email address, a password hash, account permissions, and information needed to verify sign-in or recover an account. The application does not store your account password in plain text.
• Contributions and correspondence: board posts, uploaded content, messages, and information you choose to submit. Content you publish on a public page may be visible to anyone; member pages are accessible to signed-in users. Do not submit information you do not intend to share with that audience.
• Essential technical information: IP address, browser information, session identifiers, request information, and security or error events used to deliver the site, manage sessions, investigate faults, and prevent abuse. Hosting and mail systems may also maintain operational logs.
• Optional usage analytics: only after you enable analytics, the CMS records the visited page, time, broad browser/device category, a separate random identifier for the session, whether the visit is an administrator visit, and the referring website’s hostname. New analytics events do not store your login session token, account ID, full IP address, raw browser string, or URL query parameters.

Purposes and legal grounds

We use information to provide requested account and publishing functions, respond to communications, secure and maintain the service, and, with your choice, understand site usage. Where applicable Canadian privacy law requires consent, information must be collected, used, or disclosed with meaningful consent unless a legal exception applies. Where the GDPR applies, processing necessary to provide a requested service may rely on performance of a contract; proportionate security and maintenance processing may rely on legitimate interests; legal obligations may require retention or disclosure; and optional analytics relies on consent. The applicable basis depends on the actual activity and circumstances. This policy does not waive statutory privacy rights.

Cookies and your choices

The CMS uses an essential session cookie for sign-in, request security, theme preferences, and your analytics choice. The cookie lasts for the browser session; the application expires an inactive session after approximately 30 minutes. Optional analytics is off until you enable it. Use “Privacy choices” in the footer to enable or decline analytics, or withdraw a previous choice, without losing access to the site. The choice applies to the current session. Global Privacy Control and Do Not Track signals prevent optional analytics. Withdrawal stops future analytics collection; it does not automatically remove earlier records. Disabling essential cookies may prevent account and other interactive features from working.

Service providers and disclosure

Hosting, system administration, and email delivery can involve service providers that process technical information or messages to perform those services. Information may also need to be disclosed to comply with applicable law, respond to valid legal process, protect the service, or investigate misuse. Bundled theme fonts and scripts are served locally. Images, embedded content, and links added by site editors may involve other providers; visiting or loading those resources can disclose technical information to them. Providers’ locations and contractual safeguards must be assessed before a new integration is introduced.

Advertising and payments

The site displays advertising and uses third-party payment processing. Clicking an advertisement or continuing to a payment provider can disclose information to that provider under its own notice. Payment providers may collect payer, billing, transaction, device, and fraud-prevention information. The specific provider and its privacy notice should be identified at checkout. Optional analytics consent on this site does not authorize an advertising network to track you and is not consent to receive marketing email.

International processing

Canadian hosting does not guarantee that every recipient, email system, backup, or externally embedded resource is located in Canada. Personal information processed in another jurisdiction may be subject to its laws and lawful government access. Where an applicable law restricts international transfers, the operator must establish the required legal mechanism and safeguards before making such a transfer.

Retention and security

Accounts and published contributions remain in the CMS until removed or otherwise managed by the operator. The current application does not automatically expire historical analytics, account records, or contributions. Application logs rotate by size, rather than a fixed number of days, and the log entries behind security and error alerts sent to administrators are kept for the most recent 100 alerts; hosting, email, and backup retention are managed separately. Contact the operator to ask about a particular record or request deletion. The operator must determine and apply retention periods appropriate to the purpose and applicable law, including any records needed for disputes or legal obligations. Session protections, access checks, password hashing, and administrator restrictions help protect information, but no system can guarantee absolute security.

Your rights and complaints

Depending on the applicable law, you may request information about our practices, access to your personal information, correction of inaccuracies, withdrawal of consent, and deletion where permitted. Where GDPR rights apply, you may also have rights to restriction, objection, and portability, subject to the legal conditions and exceptions. Requests must be handled within the deadlines required by the applicable law; some information may need to be retained or withheld for lawful reasons. You may complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, or, where applicable, your European supervisory authority.

Children and sensitive information

Do not submit a child’s information or sensitive personal information unless the service specifically requests it and provides appropriate information and safeguards. If you believe a child’s information was collected without legally required authorization, contact the operator for review.

Changes to this notice

Updates will be posted here with a revised date. A policy update does not itself supply consent for a new purpose; additional notice or consent must be obtained where required.