Privacy policy

Last updated: 1 September 2026

This policy explains what information Tuned Research LLC collects, how it is used, and your choices.

Information we collect

How we use it

To process and ship orders, answer and continue customer-support conversations, prevent fraud and abuse, comply with legal obligations, and operate and improve the storefront. Customer support uses Tuned's first-party conversation, which can continue in website chat or through a verified email address. Public AI replies are not enabled. Support content is not sent to Meta, Google Ads, advertising audiences, or Tuned's anonymous telemetry stream. The anonymous internal stream increments hourly and daily counters only. It receives no raw advertising click ID, cookie/browser-storage identifier, full URL/query/referrer, full IP/user-agent, customer/order identifier or free-form text, and it is not sent to advertising platforms or linked to a customer. By default, we also measure the customer journey and advertising performance through first-party analytics, the Meta Pixel in your browser, and server-side delivery partners; the browser and server copies of an event carry a shared identifier so Meta counts each action once. Choosing Necessary only (or sending a Global Privacy Control signal) disables this measurement and removes its identifiers.

Sharing

We share information only with service providers needed to fulfil orders, operate the site and customer support, provide aggregate Web Analytics through Vercel, store aggregate service counters through Supabase, perform the Meta measurement described here, and comply with law. Crisp IM SAS may retain historical website-chat records created before its widget was disabled; the storefront no longer loads Crisp. Current support records are stored in Supabase. When you verify an address for support notifications, Customer.io receives that address and our reply text to deliver the functional notification; this may create a support-only Customer.io contact even when analytics is disabled, but it does not subscribe that address to lifecycle marketing. Replies you send to the opaque support-reply address arrive in Tuned's own Proton mailbox and are filed into your conversation by our signed first-party service; no third-party inbound email provider is involved. Public AI replies are not enabled. Vercel and Supabase act as service processors for the internal aggregate stream; it is not reused for advertising or exported at event/user level. Customer.io (Peaberry Software Inc., EU-hosted) also acts as our lifecycle email service provider: it receives your email address, first name, order history events, and — unless you chose Necessary only or send Global Privacy Control — anonymous browsing events, solely so we can send order-related and, where you have not opted out, marketing email. Every marketing email contains an unsubscribe link, and Customer.io data is never used by us for advertising audiences or bidding. We do not sell your personal information.

Support retention

Tuned keeps first-party support conversations so customers and our team can continue a thread. The opaque browser access key normally expires after 30 days, and first-party support conversations are deleted after 13 months by our support-retention process. We also delete conversations and contact records in response to a verified request, subject to legal, fraud-prevention and recordkeeping needs. Crisp may separately retain historical records and technical logs from the discontinued service under its legal obligations. You can request access, correction or deletion using the address below.

Your choices

You may request access to, correction of, or deletion of your personal data by emailing support@tunedresearch.com. You can opt out of marketing email at any time. Analytics and advertising measurement runs by default. Necessary only disables advertising and user-identifying analytics. Tuned continues to collect anonymous, aggregate service-performance and storefront-interaction statistics that are not used for advertising or linked to a customer. Choosing Necessary only removes Tuned's first-party analytics identifiers and stops future analytics and advertising calls. Customer support remains available through first-party website chat and verified email continuity. The storefront does not contact Crisp or create a new Crisp support-session cookie. You can separately , which takes effect immediately and also suppresses Vercel Web Analytics on future page views.

Global Privacy Control

If your browser sends a Global Privacy Control signal, we suppress anonymous aggregate service measurement, remove first-party analytics identifiers and the tab-scoped Meta click value, and block analytics or advertising destination calls from our first-party tracking hub. This does not affect email customer support.

Cookies

We use cookies and local storage to keep your cart, remember your age confirmation and privacy preferences, and—by default—measure site and advertising performance. This includes first-party _dcid, _fbp, and _fbc identifiers. Tuned's first-party chat stores tuned_support_token, an opaque conversation-access key, in local storage after the customer sends a message; it normally expires after 30 days. A historical Crisp crisp-client/* cookie may remain until it expires, but the storefront does not read it or contact Crisp. Earlier consent-limited visits may have stored only fbclid and its first-seen time in _tt_landing_meta session storage for the current tab; it is no longer created and is cleared for Necessary-only or GPC. Anonymous internal telemetry and cookie-free Vercel Web Analytics do not set visitor identifiers; internal-telemetry storage is limited to an optional tuned_internal_telemetry_optout preference flag, its host-only session-cookie fallback when DOM storage is unavailable, and coarse source/campaign categories kept in session storage for the current tab. The preference contains only an off flag; those categories contain no click ID, URL, timestamp, random value, or visitor/session identifier, and all are cleared or suppressed when anonymous telemetry is disabled or GPC is present. The Meta Pixel runs in your browser by default and uses the first-party _fbp and _fbc identifiers; it is disabled for Necessary-only and Global Privacy Control visitors and stops (with its identifiers removed) if you opt out. No supplemental Tagada browser tracker is installed. Hourly internal counters are kept for 90 days and daily counters for no more than 13 months. For detail, see our Cookie Policy.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you may have the right to know the categories and specific pieces of personal information we collect, to request deletion or correction of your information, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information. Our default-on advertising measurement (the Meta Pixel and Google tag) may constitute "sharing" under the CPRA; you can opt out at any time through the "Cookie preferences / Do Not Sell or Share" control in the site footer (choose Necessary only), and we honor the Global Privacy Control signal automatically as an opt-out of sale/sharing. We will not discriminate against you for exercising applicable privacy rights. To submit a request, email support@tunedresearch.com; you may use an authorized agent. The categories we collect are described above under "Information we collect."

Other US state privacy rights

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out. Submit requests to support@tunedresearch.com. You may appeal a declined request by replying to our response.

UK & EU (GDPR)

Where the UK GDPR or EU GDPR applies, we process personal data on the lawful bases of contract (to fulfil your order), legitimate interests (to run and secure the site and prevent fraud), consent (for optional analytics, advertising measurement, and marketing), and legal obligation. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. Data may be transferred to and processed in the United States under appropriate safeguards.

Children's privacy

This site and our products are intended only for adults aged 21 or older. We do not knowingly collect personal information from children. If you believe a minor has provided us information, contact us and we will delete it.

Changes

We may update this policy from time to time; changes take effect when posted here. See all policies on our Legal & Compliance page.