Privacy Policy

This page explains what within collects, why, who sees it, how long we keep it and what you can do about it. We follow Canada's PIPEDA and, where it applies, the GDPR.

The short version

• We do not sell personal information.
• You can browse without an account. A random ID on your device lets us remember what you like.
• When you buy, the boutique is the seller, and it gets what it needs to fill your order.
• Your card goes to Stripe or Square when you pay on within, and we never see the number.
• Google Analytics and PostHog measure visits, and you can turn them off on this page.
• To see, correct or delete what we hold about you, write to support@shopwithin.co.

Who we are

The service is operated by within, from Toronto and New York. The company behind it is ShopWithin LLC. For any privacy question or request, write to the address at the end of this page.

What we collect

When you browse

• A random device ID. On your first visit we set a cookie holding a random ID. It is not tied to your name or email address unless you sign in.
• What you do on within. The pieces you open and how long you look at them, and what you save, search for, follow, add to your bag and buy. We also note the pieces shown to you and your answers to the style questions, and store it all against the device ID.
• Where you are, roughly. The area you choose is kept in a cookie. Your device location is used only if you tap to share it, and it stays on your device. Our servers see it only rounded to about 11 metres, to measure distances, and never save it to your account or your history.
• Alerts, if you turn them on. Price drops on pieces you saved, restocks, and new pieces at boutiques you follow. We keep what your browser or phone needs to deliver them.
• A creator's code. If a creator's link brought you here, we note their code for 30 days, so they are credited if you buy or join the waiting list.
• Your IP address. Like any website, our servers and analytics tools receive it. We use it to stop abuse and to tell which country a visit comes from.

We also run a test version of within. What you do there is stored apart from shopwithin.co and never changes what shopwithin.co shows you.

When you make an account

You sign in with a link we email you, or with Google or Apple, which tell us your email address. There is no within password.

Your account holds your email address, your saves and boards, your sizes and any delivery addresses you keep. When you sign in, this browser's device ID is linked to your account, so your saves and your taste follow you. If you choose to save a card, Stripe keeps it, and we keep only a reference to it.

When you buy

On within's own checkout we collect your name, email address and phone number, and what you bought and paid. When a piece is sent to you, we also collect your address and any delivery note.

When you continue to a boutique's own checkout, you pay the boutique there. If you are signed in, we fill in your email address and saved address for you.

The boutique's online store then sends us that order, with your name, email address, phone number, address and the pieces. We use it to show you the order's progress, to email you a link to follow it, and to collect our commission.

If you review a purchase, the review carries your first name only.

When you join the waiting list

We keep your email address, your own code to share, the code of whoever invited you, how you found within, and a creator's code if your browser holds one. We write when you join and when your access is ready. The founders also write to the list now and then, and each of their letters ends with a link to leave.

When you search with a photo

The picture is sent to our servers, compared with the photographs of the pieces on within, then discarded. We never store it or pass it to anyone else. If you paste a TikTok or Pinterest link instead, we fetch the picture from that site.

When you join as a creator

We keep your name, handle, city, email address and PayPal address, and count the clicks and sales your link brings. You see each sale's amount and your share, never who bought.

If you run a boutique

• Store profile, catalogue, inventory, and order data synced from your commerce platform (Shopify, Square, Lightspeed, Squarespace, or WooCommerce) to list your products and route orders.
• Payout details you provide to our payments processor to receive funds (handled by Stripe; see below).
• For Square boutiques, shoppers pay on your Square account through within's Square application. within collects its commission as a Square application fee and reads the resulting payment and refund records to keep your within counter in sync.
• The email address you sign in with, and how you use the boutique dashboard. PostHog measures that use, with replays that hide passwords, contact details and payment fields.
• When you ask to join, the details on the form: the boutique's name, your name, email address and phone number, and the boutique's website and Instagram handle.
• Public details about boutiques we would like to invite, such as the shop's name, address, website and published contact details.

When a boutique removes within from Shopify, Shopify asks us 48 hours later to delete that store's data. We delete it, keeping only the order records our accounts need, with shoppers' details removed. When a shopper asks a boutique on Shopify to erase their data, we remove their name, email address and phone number from our orders too.

How we use it

We use what we collect to:

• show you pieces you are likely to want, and how far away they are;
• run your account, your saves and the alerts you choose;
• pass your order to the boutique, send your order emails and show you where an order is;
• credit creators for the sales their links bring, and collect our commission from boutiques;
• keep within working and safe, and stop fraud and abuse;
• learn which pages and features work, so we can improve them.

What we never do

• Sell your personal information.
• Run advertising trackers, or use your information to show you other companies' ads.
• Share one boutique's sales with another boutique.
• See your card number when you pay on within.

Who we share it with

We do not sell personal information. We share it only with the people and companies below, and only what each one needs:

• The boutique you buy from. It gets your name, contact details and what you bought, and your address when it sends the piece to you. When you pay on its own checkout, its own privacy policy applies to that purchase too.
• Shopify, Square, Lightspeed, Squarespace, WooCommerce. The boutique's commerce platform, to sync catalogue and route orders.
• Stripe or Square, depending on the boutique. Payment processing and merchant payouts for orders paid on within. At a Square boutique your card is charged on the boutique's own Square account and Square handles the card details; within never sees the number.
• A courier company (Uber Direct), only when an order goes out by courier: your name, phone number, address and delivery note.
• Hosting and storage (Vercel, Railway, Supabase), email (Resend) and analytics (Vercel Web Analytics, Google Analytics, PostHog), acting on our instructions.
• An address search service, which receives what you type into an address box so it can suggest matches.
• The push service of your browser or phone, which carries the alerts you turn on.
• PayPal, which carries payouts to creators.
• Creators. A creator sees that an order came through their link and its amount, never who bought.
• The authorities, when the law requires it.

Cookies and analytics

Cookies are small files a site keeps in your browser. These are the ones within sets:

• within_uid. A random ID for this browser, so within remembers your taste and your saves without an account. Kept for one year.
• within_session. Keeps you signed in. Kept for 180 days, or until you sign out.
• within_door. Your early access pass. Kept for 30 days.
• within_seat. Your place on the waiting list. Kept for 180 days.
• within_aff. The code of the creator whose link brought you to within. Kept for 30 days.
• within_anchor. The area you chose, or your rounded device location if you shared it, so distances are measured from there. Kept for one year.
• within_dept, within_lens, within_cities, within_cols, within_figure, within_flags, within_new. How the site looks for you: women, men or both, the style you picked, your cities and the size of the grid. Kept for up to one year.
• within_internal. Marks a browser our own team uses, so its visits stay out of our numbers. Kept for two years.

Your browser also keeps some things on this device only: your bag, the pieces you viewed recently, your sizes and the choices you make on the site. It also remembers the email address you last signed in with. Clearing this site's data removes them.

To see what works, within uses three analytics tools, on shopwithin.co only:

• Vercel Web Analytics counts visits and page speed without cookies.
• Google Analytics counts visits and the pages and pieces viewed, with its own cookies. Its advertising features are switched off.
• PostHog records the pages you open, the steps you take and any errors you hit, and replays each visit so we can see where the site goes wrong. Replays show the pages and what you type in search, and hide passwords, email addresses, phone numbers, names, addresses and card details. PostHog receives your device ID or account number, never your email address.

In the European Union, the European Economic Area, the UK and Switzerland, a banner asks first. Google Analytics and PostHog store nothing on your device until you choose Allow; choose Decline and only cookieless measurement remains.

Everywhere else, they start on your first visit. We tell which applies from the country your connection comes from. You can turn them off on this browser at any time with this button.

Turn off analytics on this browser

How long we keep it

• Browsing history. Deleted after 180 days. A taste profile that goes unused for 180 days is deleted too.
• Your account. Kept until you delete it.
• Orders. Kept as long as tax, accounting and dispute rules require.
• Photos you search with. Never kept.
• The waiting list. Kept until you ask us to delete your entry. Leaving the list stops our letters.
• Cookies. As listed above, unless you clear them sooner.

Your choices and rights

You can ask to see, correct or delete the personal information we hold about you. Write to support@shopwithin.co, and we will respond within the timeframes the law requires.

• Deleting your account. Write to us from the email address on the account. We then delete the account, its saves, boards, sizes and addresses, any card saved with Stripe, your browsing history and your alerts.
• Past orders. They keep their amounts for our accounts, without your name, email address or phone number. A review you wrote then reads “a verified buyer”.
• Your device ID. Clear this site's cookies to remove it. Signing out also gives this browser a new one.
• Analytics. Turn them off with the button under Cookies and analytics.
• Alerts. Turn them off in Settings, or in your browser's settings.
• Emails. To leave the waiting list, use the link at the foot of a letter. Order emails come only with an order. To stop any other email from us, write to support@shopwithin.co.
• Purchases from a boutique. You can also ask that boutique directly.

Children

within is not directed to children under 16, and we do not knowingly collect their information.

Where your information is kept

Our servers and our database are in the United States, and so are the analytics companies we use. Your information is stored and processed there, outside Canada and Europe, wherever you live.

Security

We use encryption in transit, scoped access, and reputable processors.

Payment card details are handled by Stripe or Square, depending on the boutique, and never touch our servers. The card form is theirs, and we receive only a single use token. On a boutique's own checkout, your card goes to that boutique's payment provider.

Changes

When this policy changes, we update this page and the date at the top. If a change is significant, we will also say so on within.

Contact

Questions or requests: support@shopwithin.co. You can also reach us through our contact page.