Your data.
Kept plainly.
This page says what we collect when you use corropt.com, why, who processes it for us, how long we keep it, and how to get it back or have it deleted. No legal fog. Last updated 28 September 2026.
The controller.
Corropt & Chroma runs corropt.com and decides what happens to the personal data collected through it. For anything on this page, write to hello@corropt.com.
We ship worldwide. If you are in the UK or the European Economic Area, the UK GDPR and the EU GDPR apply to how we treat your data. In Zimbabwe, the Cyber and Data Protection Act applies. We hold ourselves to the same standard everywhere.
Only what the action needs.
Page views and load times are measured with Vercel Analytics and Speed Insights, which are cookieless and do not build a profile of you. If you arrive from a link with campaign tags (utm_*) or a referring site, we keep those tags in your browser for the visit so a later checkout can be attributed to the post that sent you. That is about the link, not you.
When you subscribe to Notes from the studio or join a drop waitlist we store your email address, the time you signed up, your browser's user-agent string and the page you were on. We also create a customer record in Shopify flagged as accepting marketing, and send you a welcome email. Joining the list is your consent to receive our emails. Every one carries an unsubscribe link.
If you're on the list, or signed in with marketing emails on, we also keep a copy of what's in your bag (the pieces, colours, sizes and quantities). If you leave items there without going to checkout, we send you one reminder email, usually later that day or the next. Each reminder has a link to stop them.
Accounts are Shopify customer accounts. Shopify holds your password; we never see it. Your name, delivery addresses, order history and wishlist are shown to you when you sign in. Your wishlist, cart and currency choice live in your own browser storage, not on our servers.
Checkout runs on Shopify. Shopify and its payment providers collect your payment details, billing and delivery address and contact details. We never receive or store card numbers. We receive your order, contact and delivery details so we can make, pack and ship the piece and answer questions about it. If you start checkout and don't finish, Shopify sends you one email about that order so you can pick up where you left off. It has an unsubscribe link.
The returns form sends your order number, email address and the reason you give straight to the studio inbox so we can send a label and process the refund. Nothing from that form is stored anywhere else.
If you put a run from today's course on the leaderboard, we store the runner name you choose, your email address, and your score and distance. The moves you made in the run are replayed on our server to check the score, then discarded. If you add an Instagram handle and finish the day at #1, it shows on the flag at the start gate. Only your runner name and score are shown to anyone. We use your email to give the day's top 5 Waitroom priority for the next drop, to work out the monthly board from your best daily scores, to contact you if you win the monthly prize or daily store credit, and to issue the credit. If you claim the story-share credit we also store the Instagram handle you give us, to check your story. It does not add you to the marketing list. If you tick the streak reminder, we also keep your runner name, email and streak length so we can email you at most once a day when your streak is about to end; every email has a one-click unsubscribe. Your progress, missions and Mud balance stay in your own browser storage. To see whether the game is any good, we also keep an anonymous play summary for each day (a random id made on your device, how many runs you did and how far you got, and your star rating if you give one). It isn't linked to your email or name and is deleted after 60 days. If you use Challenge a friend, the link carries your runner name (if you have one), your distance and your score, and nothing else.
Email, WhatsApp and Instagram messages are kept for as long as the conversation is useful, then deleted. WhatsApp and Instagram are run by Meta and their own privacy policies apply to messages sent through them.
The reasons.
- To fulfil your order — making, shipping, tracking and returns. Legal basis: performance of a contract.
- To run your account — sign-in, order history, saved addresses. Legal basis: performance of a contract.
- To send drop news and studio notes — only to people who joined the list. Legal basis: your consent, which you can withdraw at any time.
- To run the Mud Run leaderboard — showing ranks, giving the top 5 Waitroom priority, running the monthly giveaway and the daily store credit. Legal basis: performance of a contract (the leaderboard you chose to enter).
- To answer you when you get in touch. Legal basis: our legitimate interest in running the studio.
- To understand what works — which posts bring people to the site, which pages load slowly. Legal basis: legitimate interest, using cookieless measurement.
- To meet legal obligations — tax, accounting, fraud prevention and responding to lawful requests.
We do not sell your data. We do not use automated decision-making or profiling that has a legal or similarly significant effect on you. We do not use AI systems to process your personal data.
Named, not “trusted partners.”
- Shopify (Shopify International Ltd / Shopify Inc.) — customer accounts, checkout, payments, order records, and the marketing list. Checkout domain pay.corropt.com.
- Vercel (Vercel Inc.) — hosts corropt.com, stores list signups in Vercel Blob storage, and provides cookieless analytics and speed measurement.
- Resend (Resend Inc.) — sends our welcome, drop and return-request emails.
- Payment providers selected inside Shopify checkout — they process your payment under their own policies. We never see card details.
- Couriers — receive your name, address and phone number to deliver the piece.
- Meta (Facebook, Instagram, WhatsApp) — if you message us there, and, only with your consent in the banner, the Meta Pixel for measuring which posts bring people to the site.
- Google (Google LLC / Google Ireland Ltd) — Google Analytics for measuring visits and purchases: on corropt.com only with your consent in the banner, and on checkout as described in section 05. Our product catalogue (not your personal data) is shared with Google Merchant Center so pieces can appear on Google Shopping.
Each of these acts on our instructions under a data processing agreement or their published terms. Several are based in the United States, so your data leaves Zimbabwe, the UK and the EEA. Transfers rely on the providers' standard contractual clauses and equivalent safeguards.
Two cookies, both ours.
- cc-session — set only when you sign in. Holds your Shopify account token so you stay signed in. Server-only, lasts 30 days or until you sign out.
- cc-authed — set alongside it. A yes/no flag so the page knows to show your account menu. Lasts 30 days or until you sign out.
- Browser storage (not cookies) — your cart, wishlist, currency choice, whether you have already joined the list (and the email you joined with), and this visit's campaign tags. Stored on your device and cleared when you clear site data. The one exception is the bag copy described in 02 B, kept only for people on the list.
Google Analytics and the Meta Pixel are built into the site but load only after you press “Allow” in the small banner at the bottom of the page. Say no, or say nothing, and they never load. Your answer is kept in browser storage on your device (not a cookie) so we do not ask again; clear site data to change it. When they are on, Meta and Google receive the pages you view and, if you buy, the checkout event, under their own policies.
Checkout runs on Shopify at pay.corropt.com and has its own cookie banner. Shopify shows it in regions where the law requires consent, including the UK, the EEA and Switzerland; there, Google Analytics runs on checkout only if you accept. In other regions, checkout measurement is on by default.
Then it goes.
- Marketing list — until you unsubscribe or ask us to delete you. Unsubscribing removes you from sends immediately.
- Account — until you ask us to close it. Closing deletes the Shopify customer record except for order history we must keep.
- Orders and invoices — 6 years from the order, to meet tax and accounting rules.
- Return requests and correspondence — 12 months after the matter is closed.
- Bag copies for reminders — deleted once the bag is emptied, 3 days after you go to checkout, 3 days after it was last changed if no reminder was sent, or 14 days after the reminder.
- Mud Run leaderboards — 60 days after the day they were run, then deleted.
- Mud Run streak reminders — until you unsubscribe, or 60 days after the last run you saved, then deleted.
- Server logs — held by Vercel for a short rolling window, then dropped.
Ask, and we do it.
- Access — a copy of everything we hold about you.
- Correction — fix anything wrong. You can edit addresses yourself in your account.
- Deletion — we delete you from the list, our storage and Shopify, except records the law makes us keep.
- Withdraw consent — unsubscribe from any email, or write to us.
- Object or restrict — tell us to stop or limit a particular use.
- Portability — your data in a machine-readable file.
- Complain — to the ICO (UK), your local data protection authority (EEA), or POTRAZ (Zimbabwe). We would rather you told us first.
Email hello@corropt.com from the address you used with us and say what you want. We answer within 30 days and never charge for it. If we cannot verify it is you, we will ask for something that proves it before we act.
Security, children, changes.
- Security — the site is served over HTTPS only, sign-in tokens are server-only cookies, and access to our storage and Shopify admin is limited to the studio. No system is perfect; if something goes wrong with your data we will tell you and the relevant authority as the law requires.
- Children — corropt.com is not aimed at anyone under 16 and we do not knowingly collect their data. If a child has given us theirs, write to us and we will delete it.
- Changes — when we change how we handle data, we update this page and the date at the top before the change goes live. Material changes are also announced to the list.
One inbox.
Corropt & Chroma
hello@corropt.com