Privacy policy

Last updated: 1 November 2026. This version takes effect on the date above.

This policy explains what First Thing Bars, Inc. ("First Thing Bars", "we", "us") collects about you when you use firstthingbars.com, buy from us, subscribe, or write to us, what we do with it, who helps us handle it, and the choices you have. We sell only to customers in the United States.

The short version

We collect what we need to send you bars and answer you: your name, email, shipping address, what you ordered, and anything you write to us.
We never see your full card number. Payment happens on Stripe's own checkout page.
We do not sell your personal information, and we do not share it for targeted advertising. This site has no advertising pixels. We count visits with Cloudflare Web Analytics, which uses no cookies and does not identify you.
You can ask to see, correct or delete what we hold about you by emailing hello@firstthingbars.com.

What we collect

When you place an order or subscribe: your name, email address, shipping address, phone number if you give one, what you bought, the price, and your order history with us. If you subscribe to the Weekday box, we also keep the date of your next billing and whether your subscription is active.

Payment details: you pay on a checkout page run by Stripe, our payment provider. Your card number goes to Stripe, not to us. Stripe tells us only what we need to run the order, such as the card brand, the last four digits, the billing address, and whether the payment went through.

The email box at checkout: under the email field on Stripe's checkout page is a box that reads "Keep me updated with news and personalized offers." It is usually already ticked, and you can untick it before you pay. Stripe tells us whether it was ticked. If you leave it ticked and do not finish paying, Stripe still gives us your email address, your name if you typed it, and what was in your cart.

When you join the waitlist: your email address.

When you use the contact form or email us: your name, email, phone number if you give one, and your message.

When you leave a review: your star rating, what you write, the order it belongs to, and the name shown with it.

When we email a business: some of our emails to business buyers contain a tiny image that tells us whether the email was opened.

When a business applies for wholesale: the business name and type, the contact's name, email and phone, the delivery address, resale certificate details (state and number), and anything else written in the form.

When you visit the site: the company that serves our pages, Cloudflare, receives the technical details any website receives, such as your IP address, browser type and the page requested, and uses them to deliver the page and block attacks. Cloudflare also counts our visits for us (Cloudflare Web Analytics): which pages are viewed, how fast they load, the website that sent you, your country, and your type of device and browser. It sets no cookies, keeps nothing in your browser, does not store your IP address for these counts, and does not follow you to other websites. We also count, per product and per day, how often Add to cart is pressed, the cart is opened and checkout begins; nothing about you is stored with these counts. If the link you arrived on carries a campaign label (for example, one showing it came from our Instagram or a newsletter), we note that label, the website that sent you and the first page you landed on. If you place an order, we save them with it, so we know which posts and partners bring customers.

Cookies and similar technology

We do not use advertising or analytics cookies. The site saves a few small settings in your own browser, such as products you recently viewed and whether you closed a pop-up. These stay on your device and are not sent to us, with one exception: the campaign label, referring website and landing page described above are kept in your browser and sent to us, and with your order to our payment processor, only if you place an order. Cloudflare may set a security cookie that helps it tell people from bots. Stripe sets its own cookies on its checkout page to prevent fraud; its privacy policy explains them.

Our homepage includes a Spotify music player. When it loads, Spotify can collect information about your visit under its own privacy policy, and may recognize you across other sites that use Spotify. Links to Instagram and TikTok take you to those services, which are covered by their own policies.

How we use it

To take payment, pack and ship your order, and run your subscription.
To send you emails about your order: a confirmation, a shipping notice with tracking, and for subscribers, notices about your subscription.
To answer your messages and handle any problem with an order.
To sort the messages you send us, prepare draft replies, and put together a monthly summary of what customers like, dislike and ask for, so we can improve our bars and our service. We use an artificial intelligence (AI) tool to do this. Every reply is sent by one of us, never automatically.
To send you news and offers by email, only if you joined the waitlist or placed an order with the email box at checkout left ticked. Every one of those emails has an unsubscribe link.
If you leave the email box ticked and do not finish paying, to send you one reminder email about that cart. It goes even though you did not buy. It does not add you to our news and offers emails, and it has an unsubscribe link.
To review wholesale applications and supply approved accounts.
To prevent fraud, keep our records for tax and accounting, and meet our legal duties.

Who we share it with

We share personal information only with the companies that help us run the shop, and only what each needs for its job:

Stripe processes payments, runs subscription billing, and provides the page where you manage or cancel your subscription. When you place an order, Stripe also receives the campaign label, referring website and landing page saved with it.
WSI, our fulfillment partner in Texas, receives your name, shipping address, phone number if given, and what you ordered, so it can pack and ship your box. The shipping carrier it hands the box to receives your name and address.
Google provides our business email (Google Workspace), which sends our order and shipping emails, and Google Cloud, which runs the service that records orders and form messages.
Supabase provides the database where we keep customer and order records.
Cloudflare hosts and delivers this website and counts our visits.
Anthropic provides Claude, the AI tool we use to sort your messages, draft our replies for us to check, and summarize customer feedback, including product reviews. It receives the text of your message or review, and your name and email address when they are part of it.

We may also disclose information if the law requires it, to protect our rights or someone's safety, to our professional advisers, or to a buyer if the business is ever sold, in which case this policy would continue to apply to it.

We do not sell personal information, and we do not share it with anyone for targeted advertising.

Do Not Track and Global Privacy Control

We do not track you across other websites, so we treat every visitor the same whether or not the browser sends a "Do Not Track" signal. If your browser sends a Global Privacy Control signal, we treat it as a request not to sell or share your information, which we already do not do, and we also switch off our visit counting and campaign labels for that browser.

How long we keep it

We keep order and payment records for as long as tax and accounting rules require. We keep your waitlist email until you unsubscribe or ask us to delete it. We keep messages and wholesale applications for as long as we are dealing with you, and then only as long as needed for our records. If you leave a checkout without paying, we delete the details from it after 90 days, unless you have since ordered or joined the waitlist. Backup copies of our records are kept for 30 days, so a deleted detail can remain in a backup for up to 30 days more.

How we protect it

Card data stays with Stripe. Our customer records sit in a password-protected database that only the founders and our order service can reach. No system is perfectly secure; if a breach ever exposes your personal information, we will tell you as the law requires.

Your choices and rights

See, correct or delete your information. Email hello@firstthingbars.com with the subject "Privacy request" from the email address you used with us, and say what you want. We may ask a question to confirm it is you. We will answer within 45 days.
Get a copy. Ask the same way and we will send what we hold about you in a common format.
Stop marketing email. Untick the email box at checkout, or use the unsubscribe link in any marketing email, or email us. Once you unsubscribe, a box left ticked on a later order does not sign you up again. We will still send emails about orders you place.
Cancel your subscription. Go to firstthingbars.com/account any time.
If we say no. If we turn down a privacy request, reply to our answer and ask us to look again. We will tell you the result and the reason.
Someone acting for you. You can have someone else make a request for you. We will ask for proof that you authorized them.

We will not treat you differently, charge you more, or refuse you service for using any of these choices. A summary is on our privacy choices page.

Children

This site is not meant for children under 13, and we do not knowingly collect information from them. If you believe a child has given us personal information, email us and we will delete it.

Changes to this policy

If we change this policy, we will post the new version on this page with a new date at the top. If a change affects how we use information we already hold about you, we will also email customers and subscribers before it takes effect.

Contact us

Questions or requests about your privacy:

First Thing Bars, Inc.
211 W Wacker Dr, Ste 120 #1171
Chicago, IL 60606

hello@firstthingbars.com