Wellness Wednesdays are community night: $15 Sessions
Privacy, plainly.
We ask for what we need to hold your seat, take your payment, and keep you safe in the heat. This page says what we collect, who we hand it to, and how to make us stop. No dark patterns, no fine print.
We collect your name, email, phone, birthdate, and what you’ve booked or bought. We never see your full card number. We share scrambled versions of your email, phone number and name with Google and Meta so we can tell which ads actually bring people here. Email us and we’ll stop.
What we collect, and why.
What You Give Us
Your name, email address, phone number, and date of birth when you create an account, sign a waiver, or book a session. Date of birth is used to verify you meet our age requirements — nothing else.
Your Activity Here
Sessions you book, memberships and credit packs you buy, event tickets you hold, gift cards you send or redeem, and waivers you sign. We keep this to run your account and honor what you've paid for.
Payment Information
Card payments are processed by Square. Your full card number never reaches our servers and we cannot see it. We retain only what Square returns to us: the amount, a payment reference, and the last four digits.
Technical Information
Standard web data your browser sends — IP address, device and browser type, pages viewed, and the referring link. If you arrive from an ad, that link carries a click identifier so we can tell which ads bring people to Puffin.
What we do with it.
Running Puffin
Improving & Growing
We do not use your information to make automated decisions about you, and we do not build profiles about your health, beliefs, or personal life. Nothing you tell a guide in the sauna ends up in a database.
Everyone who touches your data.
| Who | Why | What they get |
|---|---|---|
| Supabase | Account database and authentication | Account and booking records |
| Vercel | Website hosting | Technical request data |
| Square | Payment processing | Name, email, payment details |
| Resend | Booking confirmations and receipts | Name, email |
| Klaviyo | Marketing email, if you've opted in | Name, email |
| Google (Analytics & Ads) | Site analytics and ad measurement | Technical data, hashed email |
| Meta | Ad measurement | Technical data, hashed email, phone and name |
Each of these providers is bound by contract to use your information only to deliver their service to us. We may also disclose information if the law requires it, or to protect someone’s safety. If Puffin is ever sold or merged, member records would transfer with the business — we’d tell you before that happened.
§ 04 / Advertising & Measurement
How we tell whether our ads work.
We advertise on Google and Meta. To know whether that money brings anyone to the sauna, we have to connect an ad you clicked to a booking you later made. Two things make that possible.
A click identifier. When you arrive from an ad, the link carries a tag that Google or Meta reads back later. It identifies the ad, not you.
A scrambled email. When you complete a purchase, we may send Google and Meta a one-way cryptographic hash of your email address, phone number and name — a fixed string of characters that cannot be reversed back into the original. They compare it against hashes they already hold to see whether you were the person who clicked. We send the purchase amount alongside it. We never send your email address, phone number or name in plain form, and we never send your birthdate or anything from your waiver. We hold no billing address, so none is shared.
We do not sell your personal information for money, and we never have. Some privacy laws define “sale” or “sharing” broadly enough to cover the ad measurement described above, so we’re naming it here rather than hiding behind the definition. Email info@puffinsauna.com and we’ll exclude you. It changes nothing about your account, your bookings, or your rates.
Small files, plainly described.
Essential cookies keep you signed in and hold your booking together while you move through checkout. The site does not work without them.
Analytics and advertising cookies come from Google and Meta. They record which pages you visited and which ad you arrived from. You can block or clear them in your browser settings, or opt out at Google Ad Settings and Meta Ad Preferences. Blocking them will not break booking.
We don’t currently respond automatically to browser “Do Not Track” or Global Privacy Control signals — the standards are inconsistent and we’d rather not claim more than we do. Email us and we’ll apply the opt-out by hand.
What you can ask us to do.
See What We Hold
Ask us for a copy of the personal information associated with your account and we'll send it to you.
Correct It
Most details are editable directly in your member portal. Email us for anything you can't change yourself.
Delete It
Ask us to delete your account and we will, except for records we're required to keep — completed transactions and signed waivers, which we retain for tax and liability purposes.
Opt Out of Ad Measurement
Email us and we'll exclude your information from the advertising measurement described in section 05. Your account and bookings are unaffected.
Stop Marketing Email
Every marketing email has an unsubscribe link at the bottom. Unsubscribing never stops booking confirmations, receipts, or safety notices — those aren't marketing.
Take It Elsewhere
Ask and we'll provide your information in a portable, machine-readable format.
Email info@puffinsauna.com for any of these and we’ll respond within 30 days. We won’t charge you, and we won’t treat you differently for asking.
How Long We Keep It
Account information for as long as your account is open, then deleted on request. Transaction records and signed waivers are kept for seven years for tax and liability reasons, even after an account closes.
How We Protect It
Encrypted in transit and at rest. Access is limited to staff who need it, and card data lives with Square rather than with us. No system is perfect, and we won’t pretend otherwise — if a breach affects you, we’ll tell you.
Children
Accounts are for adults. Minors aged 14+ may attend Family Hours with a parent or guardian, whose account holds the booking. We don’t knowingly collect information from anyone under 13, and we delete it if we find it.
Questions about any of this? info@puffinsauna.com
Puffin Sauna Club LLC · 9417 N Foothills Hwy, Boulder, CO 80503. If we change this policy in a way that matters, we’ll update the date below and email account holders before it takes effect.
Last updated August 18, 2026 · Governed by Colorado Law