Privacy policy

Lit Apparel is run by Lit Apparel LLC, 937 Holmes Rd, Ypsilanti, MI 48198 ("Lit Apparel", "we", "us"). We decide how the information described here is used.

For anything about your data, reach us through our contact page or by email at hello@lit-apparel.com.

Only what a feature needs, and only when you use it:

• Account: your email address, first name, and a scrambled (hashed) version of your password. We never see or store the password itself.
• Orders: what you bought, your name, delivery address, email and phone number for delivery, and the order total. Card details go straight to our payment processor; we never receive your card number.
• Lit Crew membership: your plan, its status and renewal dates, your training plan settings (program, days, session time, time zone, reminder choices), saved recipes and favourites, forum posts and chat messages, and which version of the code of conduct you agreed to.
• Points: the Drop Points and Field Points you earn and spend, and what each was for.
• Email lists you join: newsletter sign-ups, restock alerts, and the LIT Drop Club waitlist (with the tee size and marketing choice you give us).
• Messages you send us: contact form messages, reviews, Wall of Passion entries and posts you share from the home page, with the name and email you give.
• Sightings: the kind of proof you chose, which piece it was, an optional broad city, an optional note and an optional photo. If you are signed in we link the sighting to your account so it can earn Field Points. Photos are deleted once a person has reviewed the sighting.
• Saved items and size profile: kept on your device until you sign in, then with your account.
• Virtual try-on (/fit): the photo you use is sent to our try-on provider to produce the image and is not stored by us.
• Technical data: the pages you request and basic device and browser information our hosting provider logs to run and protect the site. With your consent only, analytics data (see Cookies below).

We do not ask for, and do not want, sensitive information such as health details. Please leave it out of messages, notes and forum posts.

• To run your account, take payment, deliver orders and handle returns and exchanges (needed to perform our contract with you).
• To run Lit Crew, points, sightings and the community features you choose to use (contract).
• To answer your messages and send the emails you asked for: order and account emails, restock alerts, waitlist news (contract, or your consent for marketing).
• To keep the site secure, prevent fraud and abuse, and fix errors (our legitimate interest in a working, safe shop).
• To understand which pages and products work, using analytics only if you allow it (consent).
• To keep records the law requires, such as tax and accounting records (legal obligation).

We do not sell your personal information, and we do not share it for cross-context behavioural advertising unless you switch on Marketing cookies.

Reviews, Wall of Passion entries and shared posts appear on the site only after a person at Lit Apparel approves them, under the name or handle you gave.

Sightings are never published individually. The public sees only counts: how many confirmed sightings a piece has, and in how many cities. Never who logged them, where or when.

In Lit Crew, other members can see your forum posts and chat messages under your display name.

We use these service providers, each only for its job and under its own privacy terms:

• Netlify: hosts the website.
• Supabase: our database and private file storage.
• Stripe: takes card payments and runs memberships; it handles your card details directly.
• Resend: sends our emails.
• Google Analytics and Google Tag Manager: site measurement, only if you accept Analytics or Marketing cookies.
• FASHN: produces virtual try-on images from the photo you choose.
• UPS: delivers your orders and needs your name, address and phone number.

We may also share information when the law requires it, to protect our rights or someone’s safety, or as part of selling or reorganising the business, in which case this policy continues to apply.

Strictly necessary cookies keep your cart, sign-in and consent choice working and are always on. Analytics, functional and marketing cookies stay off until you switch them on, and you can change your mind at any time from Cookie settings in the footer.

The full list of categories and the third parties in each is in our cookie policy, which is generated from the same settings the cookie banner uses.

• Account and membership data: while your account is open, then 90 days after it is closed.
• Orders and payment records: 7 years, as tax and accounting law requires.
• Email lists: until you unsubscribe or ask us to remove you.
• Contact messages and reviews: 2 years (a published review stays while it is published).
• Sighting photos: deleted as soon as a person has reviewed the sighting.
• Server and security logs: 90 days.

Signed in, you can download a copy of your data or ask us to delete your account from the Privacy section of your account page. You can also ask us to correct something, or to stop using your data for marketing, through our contact page.

Depending on where you live (for example California, other US states, the UK or the EU) you may have further rights: to know what we hold, to correct or delete it, to take a copy, to object to or limit some uses, and to opt out of any sale or sharing for advertising. We honour these requests wherever you live, and we will not treat you differently for making one. We may need to confirm it is you before acting.

If you are in the UK or EU you can also complain to your data protection authority. We would like the chance to put it right first.

Every marketing email has an unsubscribe link.

Passwords are hashed, the database is closed to public access, uploaded files sit in private storage served only through our own site, and payments never touch our servers. No system is perfectly secure; if something goes wrong that affects you, we will tell you as the law requires.

The site is not meant for children under 13, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

We are based in the United States and our providers may process data in the US and other countries. Where the law requires, we rely on appropriate safeguards for transfers, such as standard contractual clauses.

If we change this policy we will update the date at the top, and tell you by email or on the site before any significant change takes effect.