Privacy and security
Last updated November 7, 2026. This site is run by me, Tracy Elsinger. There are no accounts or passwords. I collect only what I need to sell and ship artwork and to answer your messages, and I don't sell your information to anyone.
What I collect and why
When you buy artwork
Payments (PayPal, Apple Pay, and credit or debit cards) are handled by PayPal. I never see or store your card number. PayPal shares your name, email address and shipping address with me so I can ship your artwork and email your receipt. The site keeps a record of each order: the order number, what you bought, the amount and your email address.
Digital downloads
Each digital order gets its own private download link. It works for 30 days and a limited number of downloads. Please don't share it.
Shipping quotes
When you enter a ZIP code for a painting or drawing, it is sent to FedEx to get a live shipping rate.
Country check
I currently ship only within the United States. When you view a piece that is for sale, your browser asks ipapi.co which country you are in, so that service sees your IP address.
Contact form
Your name, email address and message are emailed to me and are not stored on the site. The form uses Cloudflare Turnstile to stop spam. To limit abuse, the site briefly keeps a scrambled (hashed) form of your IP address, never the address itself, and deletes it automatically within two days.
Advertising and measurement
The site uses Google Tag Manager and Google Ads to see which ads work. It tells Google about page views, artwork viewed, items added to the cart and completed purchases. Google may set cookies to do this. The tag is not loaded on the download page. You can turn off personalized ads in Google's ad settings or block cookies in your browser.
Saved in your browser
Your favorites and display settings (such as dark mode and whether sold pieces are shown) are saved in your own browser. They are not sent to me.
Server logs
Like most websites, the servers keep technical logs, which can include your IP address, for up to 30 days. I use them only for security and to fix problems.
Who else sees your information
Only the services that run the site: PayPal (payments), FedEx (shipping rates), Google (advertising measurement), Cloudflare (site protection and spam checks), Amazon Web Services (hosting, order records and email) and ipapi.co (country check). Each handles your information under its own privacy policy. I don't sell or rent your information, and I don't share it for anyone else's marketing.
How long I keep it
- Order records: as long as I need them for my business and tax records.
- Contact messages: in my email, until I delete them.
- Server logs: up to 30 days.
- Spam-protection records: deleted automatically within two days.
How the site is secured
- Every page is served over an encrypted (HTTPS) connection.
- Card details go straight to PayPal and never pass through this site.
- The site sits behind Cloudflare's firewall and limits which outside scripts can run on its pages.
- Download links are unique to each order and expire.
- There are no accounts, so there are no passwords to steal.
- My email address isn't published here; messages go through the contact form.
Your choices
- To see, correct or delete information I have about you, send me a message on the contact page. I'll keep only what the law requires me to keep for completed sales.
- You can block or clear cookies and site data in your browser at any time.
- This site is not meant for children under 13, and I don't knowingly collect their information.
Changes
If this changes, I'll update this page and the date at the top. See also the terms and conditions.