Optional first-party counters and Vercel Web Analytics require current consent. No session replay or advertising pixels are loaded. External images may still be fetched for user avatars, product previews, and country flags; they are not executable scripts or fonts.
Supabase
Accounts, database, uploaded files, and consented first-party event storage.
Bundled SDK; project-specific Supabase API and storage endpoints.
SDK is served with the app; managed service is external.
Stripe
Payments, fraud prevention, and designer payout onboarding.
Redirect to Stripe-hosted checkout or account onboarding; no Stripe script is injected into the app.
Hosted payment service must remain on Stripe.
Cloudflare Turnstile
Bot protection for protected forms and AI chat.
https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit and its challenge resources, when the widget mounts.
Vendor-hosted challenge script; cannot be replaced by a local copy.
Google sign-in and configured address validation, AI generation, and image moderation.
Sign-in redirects to Google. AI/address/moderation calls run on the server.
SDKs are bundled. Google APIs are external services.
Printify
Product production, shipping, and product mockups.
Product image resources may come from Printify; no executable browser script.
Fulfillment service is external; local product assets are used where available.
Fakturoid
Invoices and corrections.
Server-side API only.
External invoicing service.
Resend
Account/order notices and permitted promotional email with opt-out handling.
Server-side API only.
External email-delivery service.
Discord (when configured)
Staff order and administrative-security notifications.
Server-side webhooks only; no browser script.
External messaging service; staff access must be restricted.
Hosting provider / Vercel
Application hosting, operational request logs, and consented public-page analytics.
Application assets and the Vercel Web Analytics script served by the production deployment. Analytics loads only after current consent; no Speed Insights.
Deployment-owned assets and Vercel analytics endpoints. Page URL queries/fragments are removed, product/creator paths grouped, and private pages excluded. Local and preview deployments do not load analytics.
Geist
Interface font in the storefront and local admin.
next/font downloads at build time and serves font files from /_next/static/media.
Self-hosted; no visitor requests to Google Fonts.
System and uploaded design fonts
Fallback interface fonts and user-created artwork.
Arial/Helvetica/sans-serif use device fonts. Custom fonts are uploaded by the designer and loaded from supplied file data.
No third-party font CDN; designers are responsible for font rights.
Provider regions, contracts, and transfer safeguards depend on the production account configuration. Contact the data controller listed in the Privacy Policy for details applicable to your information.