Privacy Policy

Moira Research ("we", "us") sells research materials for laboratory use only, to adults aged 21 and over, from Utah. This page explains exactly what we collect, why, who handles it for us, and how to ask us to delete it. We do not sell your data and we do not run advertising trackers.

1. What we collect and why

• Orders: your name, email, shipping address, the items you ordered, and your phone number if you choose to give one (optional, used only for delivery problems). Used to fulfil, ship and support your order and to send order emails.
• Payment proof: we do not take cards. You pay by Venmo, so we receive the Venmo username you enter and the payment screenshot you upload. Used to match the payment to your order. Venmo's own privacy policy covers what Venmo holds.
• Research agreement record: when you place an order we record that you confirmed you are 21 or older and accepted the Research Use & Assumption of Responsibility Agreement: the name you typed to sign, the date and time, a one-way hash of your IP address (not the IP itself), and your browser's user agent. Used to prove the agreement was accepted.
• Monthly box: if you turn on "Make it monthly" we keep your name, email, phone (if given), shipping address, items, delivery day and box status, plus a private link that lets you manage the box. Used to prepare and invoice each month's box.
• Contact form and "email my link" form: your name, email and message, or just your email. Used to reply to you or to send your box link.
• Affiliate applications and accounts: name, email, phone, the code you ask for, your expected sales, and a mailing address if you choose to give one (only needed for payouts). If approved, your sign-in email and a hashed password. Used to review applications and run the program.
• Product reviews: the name, star rating and comment you submit. Approved reviews are shown publicly with the name you typed.
• Research Advisor chats: the questions you type and the answers given, a random chat ID, and a hash of your IP address (used to limit how fast one person can send messages). Used to answer you, to keep the Advisor within our research-only rules, and to review its quality. Your messages and our catalog notes are sent to Google Gemini to generate each answer (see section 3).
• Emails we send: order receipts, shipping notices, monthly-box payment links and reminders, and affiliate account emails. We keep the order and box records behind them, not a separate marketing list.
• Anonymous visit counts: we count page views and unique browsers per day and hour. No name, email or IP address is stored with these counts.
• Sign-in attempts: for affiliate and staff sign-in only, we record IP address and username to block password guessing.

2. Information we do not collect

We do not collect card numbers (we have no card processor), government ID, or precise location. The 21+ entry gate asks you on every page load and stores nothing.

3. Who handles data for us

• Vercel: hosts the website and stores uploaded payment screenshots (Vercel Blob, kept at long unguessable links).
• Turso: hosts the database holding orders, boxes, messages, reviews, applications and Advisor chats.
• Google Gemini: the Research Advisor sends your chat messages and relevant catalog notes to Google's Gemini API to generate answers. Do not put personal or health information in Advisor chats.
• Google (Gmail SMTP): sends our order, shipping, box and affiliate emails and delivers new-order alerts and contact messages to us.
• Venmo (PayPal, Inc.): the payment network you use to pay us. Venmo is your service, not our processor.
• USPS: receives your name and shipping address to deliver your parcel.
• Google Analytics: off unless we enable it. If it is ever enabled it loads only on our live site, never on staff pages, and this page will be updated first.

We do not sell, rent or trade your personal information, and we do not share it for advertising. We may disclose it when the law requires or to protect our rights, customers or the public.

4. Cookies and browser storage

We use no advertising or cross-site trackers. These are every item the site sets in your browser:

Local storage (stays on your device until cleared)

• cart: the items in your cart, so it survives a refresh.
• lastOrder: your last order summary, set when you place an order so the confirmation page can show it; removed as soon as that page reads it.
• moira-box: the private link to your monthly box, so "Open my box on this phone" works.
• pc_ref and pc_ref_ts: an affiliate code from a referral link you opened and when, so a referral is credited at checkout; ignored and deleted after 30 days.
• pc_ref_banner_dismissed:CODE: remembers that you closed the "referred by" banner.
• moira-advisor-consent-v1: remembers that you accepted the Research Advisor notice.
• moira-install-card-dismissed: when you dismissed the "Get the app" card (hidden for 30 days).
• moira_gate_v1: an old 21+ gate key. The site only deletes it if found; it is never set.

Session storage (cleared when you close the tab)

• moira-advisor-session: the current Research Advisor conversation on this tab. The Reset button clears it.

Cookies

• pc_vd: first-party, HTTP-only, expires in 36 hours. Holds the date and hour your browser was last counted so visit counts do not double count.
• affiliate_token: only if you sign in as an affiliate; keeps you signed in for 24 hours.
• admin_token and admin_session: staff sign-in only, 24 hours. Visitors never receive these.

Clearing site data in your browser removes all of the above. Nothing here is used for advertising.

5. How long we keep it

Order, payment-proof and agreement records are kept as long as needed for accounting, tax and legal obligations and to handle disputes. Monthly-box data is kept while the box is active and then only as the order records require. Advisor chats, contact messages, unapproved reviews and unsuccessful applications are kept only as long as useful to answer you and run the shop. You can ask us to delete them sooner (section 7).

6. Security

We use reasonable technical and organizational safeguards: encrypted connections, access limited to the owner, hashed passwords, and hashed IP addresses on agreement and Advisor records. No system is perfectly secure and we cannot guarantee absolute security.

7. Your requests

You can ask us for a copy of the personal information we hold about you, to correct it, or to delete it. Contact us using the details below from the email address you ordered with, and we will respond within a reasonable time. We may need to keep order and agreement records we are legally required to keep.

8. Children

This site is for adults aged 21 and over only. We do not knowingly collect information from anyone under 21. If you believe we have, contact us and we will delete it.

9. Changes and governing law

We may update this policy and will change the date at the top when we do. This policy is governed by the laws of the State of Utah, without regard to conflict-of-law rules.

10. Contact