Privacy, without the fine-print fog.
What this website does—and does not—collect.
Effective 2026-10-12
Who operates this site
This policy describes the current version of things-space.com, operated by Things Space LLC. Contact our contact form about privacy questions or requests.
Information when you visit
Your browser sends technical information needed to request a webpage, which can include your IP address, requested URL, browser information, and request time. Our web server and hosting provider process information needed to deliver and secure the site. Routine website request logging is disabled in our web-server configuration; limited operational or security information may still be recorded by infrastructure systems.
Optional analytics and necessary access cookies
Optional Google Analytics is described below. Advertising remains inactive. Password-free purchase access uses a strictly necessary secure cookie, separate from analytics.
Optional Google Analytics
On approved public pages, US visitors receive analytics with a footer opt-out rather than an opt-in popup. In the EEA, UK and Switzerland, analytics stays off until you allow it. Other or unknown locations remain off without an automatic prompt; you can opt in through Analytics preferences. A local country database makes this coarse region decision on our server: the address is not sent to a geolocation API, logged by the lookup or used for a visitor ID. IP geolocation can be inaccurate, including with VPNs. An expired or unavailable database keeps measurement off. This limited regional implementation is not a guarantee of worldwide legal compliance. Google receives technical information including IP and device information and uses first-party analytics cookies after measurement is enabled. We measure approved public page views and labeled merchant clicks, not form contents, private tokens or full merchant URLs. Google signals and ad personalization remain disabled; analytics never enables ads.
Page locations omit queries and fragments. Only approved source/medium labels and referring site origins are measured. Purchase, contact, newsletter, unknown routes and unknown queries are excluded. Analytics settings lets you withdraw consent: we stop measurement, clear accessible analytics cookies and reload. This cannot erase data already sent. Choice storage lasts up to 180 days without a user ID; analytics cookies expire after 90 days without renewal. Global Privacy Control and Do Not Track are treated as refusal. Storage restrictions may require you to choose again. Contact us for privacy requests. Google Analytics is configured for two-month user and event data retention, with reset on new user activity disabled. These controls do not affect most standard aggregated reporting; this is not a declaration of worldwide legal compliance. See How Google uses information from sites or apps that use its services.
When you contact us
Our contact form receives your name, email address, chosen reason, optional page reference, and message. These are sent through our Namecheap mailbox, not stored in a website message database. For abuse prevention, an irreversible keyed IP identifier and token fingerprint are retained for up to 24 hours; raw IP addresses and message text are not stored in that abuse database. We use these to respond, handle corrections or requests, and maintain relevant business correspondence. Please do not send sensitive personal or financial information.
Service providers and external links
OVHcloud hosts the website and Namecheap provides our email service. These providers may process technical or correspondence information as part of delivering their services. External websites and merchants have their own privacy practices. If affiliate links are introduced, those merchants or networks may use their own tracking after you follow a link.
Use and retention
We use information to operate and secure the website, communicate with you, and meet applicable business or legal obligations. Correspondence is retained for as long as reasonably needed for its purpose; relevant records may be retained longer for legal obligations or an active dispute. We do not sell personal information received through this website.
Requests and choices
You can choose not to submit the contact form or follow external links. Use our contact form to request access to, correction of, or deletion of information you have provided. We may need to verify a request and may retain information where required or otherwise permitted by applicable law. Available rights depend on your location and the circumstances.
Children
This website offers practical information for people making household and purchasing decisions; it is not directed to children. Please contact us if you believe a child has provided personal information so we can evaluate and address it.
Changes
We will update this page when our practices change. Analytics, advertising, or new data-collection features require a separate review and policy update before activation. The effective date above identifies this version.
Interactive features and reserved ad spaces
A small script served from this website provides category filtering, optional color-theme switching, and reduced-motion-aware visual effects. These features work in your browser without sending search terms or theme choices to us and without storing them in cookies or local storage. The site starts in light mode. Theme choices reset to light when you navigate or reload. Reserved advertisement spaces are layout placeholders only: no advertising network is contacted and no ad tracking is active.
Official-source stories
Our server periodically retrieves public CPSC recall notices. Your browser requests the story list and notice pages from Things Space, not directly from the agency. No search terms or visitor identifiers are sent to its feed. Cards open notices on our site. Optional official-source references open the agency website, which has its own privacy practices. Notice ad spaces are placeholders with no active advertising or tracking.
Newsletter registration
If you opt in, we store your email address, selected categories, confirmation status, and dated consent records in a private database on our OVH server. Signup is for adults aged 18 or older. Namecheap delivers only the requested address-confirmation email at this stage; weekly newsletters and marketing delivery remain disabled. Confirmation links expire after 72 hours. We do not add contact-form correspondents to the newsletter automatically.
For abuse prevention, keyed identifiers derived from the request IP address and email, and a token fingerprint, are retained for up to 24 hours; raw IP addresses and raw confirmation tokens are not stored in those abuse records. Category preferences are not used to create an advertising profile and no tracking pixel is included in confirmation emails.
Unconfirmed requests are removed after 30 days. Confirmed registrations remain until you unsubscribe or request deletion. Unsubscribed registration records are removed after 30 days. The private management link shown after confirmation lets you change categories, unsubscribe immediately, or delete your registration. You can also use our contact form for access or deletion requests, subject to verification. Newsletter-only private recovery snapshots are retained for up to seven days; a deleted record may remain in those protected snapshots until they expire.
When we decide to launch weekly newsletters, they will contain updates about your selected categories and may include commercial recommendations. We will review delivery, unsubscribe and applicable privacy requirements before enabling that separate stage. We do not sell the newsletter list.
Purchase access
For Things Space digital products, we use the checkout email and verified order, product and access-status records to provide downloads and support. Requesting access does not subscribe you to marketing. We send a requested private access link only when eligible purchases exist; responses do not reveal whether an email has purchases. Links expire after 24 hours and are single-use. Opening a link requires an explicit action; a secure, HttpOnly browser cookie then authorizes purchase access only until the original link expiry. Access records are removed after expiry. Keyed abuse-prevention identifiers expire after 24 hours. Private database recovery snapshots are retained for up to seven days. Product files are not publicly accessible. Purchase-record retention and sales policies will be finalized before live sales begin. Contact us for support or privacy requests.
Google advertising and regional choices
On approved public buying guides, Google privacy messaging loads automatically unless you have opted out or sent a browser privacy signal. The extra Things Space advertising pre-prompt has been removed. Google determines which regional consent or US state privacy message applies; ads are requested only after its consent processing is ready and remain subject to those choices, AdSense site approval and ad availability. A footer Ad privacy choices link lets you disable our loader or reopen available Google choices. Analytics and advertising remain separate. Purchase, contact, newsletter, Kids & Family, unknown routes and private queries do not load our advertising integration. Advertisements are paid placements, not Things Space recommendations.
When you load advertising, Google and its disclosed advertising partners may process your IP address, browser/device information and page information, and use cookies or local storage for advertising, fraud prevention and consent records. Google’s certified consent manager provides European choices and supported US state sale/sharing opt-outs. Consent optimization may select a standard consent message or a limited-ad message; a limited ad can still use fraud-prevention storage. Review the purposes and partners shown by Google. This policy and certified messaging do not constitute a guarantee of worldwide legal compliance.
Use Advertising choices to keep advertising off or reopen Google privacy choices on an eligible guide. Keeping advertising off stops our loader and reloads the page if it was loaded, and removes accessible first-party advertising cookies; it cannot erase data already shared, third-party cookies or copies held by providers. Global Privacy Control and Do Not Track suppress our advertising loader globally. Browser-local advertising choices expire after 180 days, contain no customer ID and do not subscribe you to marketing. Google’s consent records have their own retention periods. Browser controls can clear stored site/provider data. For privacy requests use our contact form. See Google’s partner-site privacy explanation.
Google, YouTube and website reporting integration
Things Space Publishing is an owner-operated tool for the Things Space, TS Ambience, TS Little Adventures and Things Space Reacts YouTube channels. It is not a public Google sign-in service for website visitors. Only an authorized channel owner or administrator may connect a channel.
With that person's consent, the tool accesses channel identifiers and relevant video metadata, reads aggregate YouTube Analytics reports, and can upload specifically approved videos and their metadata. Authorization is separate from approval to publish a video. The current setup has verified channel identity and reporting access; unattended uploads are not enabled. TS Little Adventures remains a separate child-directed channel without adult affiliate promotions.
With the website owner's consent, a separate read-only connection accesses the Things Space Google Analytics 4 property and Google Search Console domain property. It verifies property and website identifiers and reads aggregate website usage, search performance and sitemap information to evaluate and maintain things-space.com. Current reporting requests daily aggregate metrics, not visitor-level identifiers or raw search queries. This connection does not provide Google sign-in for website visitors, add tracking, change analytics collection or consent choices, or submit pages for indexing. Website reporting credentials are stored separately from the YouTube grants and public website. The same security, use, retention, revocation and deletion provisions in this section apply to this Google-derived reporting information. To request deletion, identify the Things Space website and your authority over its connected property. Existing disclosures elsewhere on this page describe website analytics collection and visitor choices.
With the owner's consent, a separate read-only connection accesses the Things Space AdSense publisher account and things-space.com site. It verifies account and site identifiers and readiness status and reads daily aggregate advertising performance and estimated earnings for business reporting. Current requests do not retrieve visitor-level identifiers, payment details or tax documents. This connection does not enable ads, change advertising or consent settings, modify payments, add tracking, or provide Google sign-in for website visitors. AdSense credentials are kept separately from the YouTube and website-reporting grants in restricted storage. The same security, limited-use, retention, revocation and deletion provisions in this section apply to this Google-derived reporting information. To request deletion, identify the Things Space AdSense connection and your authority over it. Revoking reporting access does not itself close the AdSense account or change independently configured ads or visitor choices.
OAuth access and refresh credentials are stored separately from public website content in restricted server storage; the owner's local credential copies are encrypted for their Windows account. Credentials, authorization codes and raw provider error bodies are not included in public pages or routine diagnostic output. Google processes API requests under its own policies. OVHcloud hosts our protected publishing service.
Google-derived information is used only to operate, verify, secure and report on the connected channels, their approved publishing workflows and the Things Space website and AdSense reporting described above. We do not sell this information, use it for advertising profiles, or use it to train general-purpose AI models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. This integration uses YouTube API Services; Google's Privacy Policy also applies to Google's handling of information.
Credentials are retained while the connection is authorized and needed. Channel and website property identifiers and reporting information are retained only as needed for the disclosed workflow. If you withdraw consent or request deletion, we stop affected access and remove the associated Google-derived information we control within 30 days, except information whose retention is required by law. Protected recovery copies age out under the same deletion deadline and are not used to restore a revoked connection.
To disconnect, remove Things Space Publishing from your Google Account connections. Revoking access does not automatically delete videos already uploaded to YouTube. For deletion of information held by Things Space, use our contact form, choose Privacy or legal request, and identify the channel and your authority over it. Do not send passwords or tokens. We verify requests before removing another person's channel information.
Google integration disclosure updated October 16, 2026.
Pinterest publishing and reporting integration
Things Space Publishing connects only the Things Space LLC Pinterest business account with its authorized owner's consent. It is not a public Pinterest sign-in service for website visitors or an application for children. Requested permissions read public account information, public boards and Pins, and allow creating, updating or deleting public Pins and boards. Pinterest also requires board-write permission for normal API Pin creation on an existing board. Our scope-correction test does not edit or delete existing boards; broader board changes require separate approval. Pinterest bundles Pin creation with update/delete permission; granting access does not itself approve any Pin change. Each scheduled Pin must be specifically chosen and approved by the owner. Trial access and testing do not establish approval for public API publishing.
For a separately authorized Sandbox demonstration, a separate token may also request permission to create, update or delete boards. Pinterest bundles these board permissions. Sandbox test boards and Pins are creator-only entities, separate from production boards; a demo permission grant does not authorize changes to existing production boards. We do not use the demo to run public campaigns.
We use this connection to verify the owned account, select its boards, prepare approved original Pins linking to Things Space content, and assess aggregate performance. We do not request advertising, billing, secret-board or profile-change access through this connection. We do not use Pinterest information for scraping, competitor research, automatic engagement, advertising profiles, sale or sharing with unrelated parties, or training AI models. API-returned account, board and Pin information is processed transiently rather than cached; only permitted analytics and minimal non-content operational status are retained as needed, subject to Pinterest's requirements.
OAuth credentials are stored separately from public website content in restricted server storage; local copies are encrypted for the owner's Windows account. The protected OVHcloud-hosted service renews credentials to maintain the same authorized connection. Secrets, authorization codes and raw provider responses are excluded from public pages and routine logs. This integration does not add a Pinterest tracking tag or change visitors' analytics consent choices. Pinterest processes requests and receives approved content under its Privacy Policy.
The owner may disconnect the app through Pinterest's security and app settings. For access or deletion requests, use our contact form, choose Privacy or legal request, and identify the account and your authority over it. Do not send passwords or tokens. On revocation, a valid deletion request, termination, or when data is no longer necessary, we stop affected access and delete Pinterest information under our control without undue delay and no later than 30 days, including recovery copies. We also comply with Pinterest's applicable deletion requests. Disconnecting does not itself delete Pins already on Pinterest.
Pinterest integration disclosure updated October 16, 2026.
Social integration deletion requests
Things Space Publisher connects our own Facebook Page, Instagram account and Threads profile to publish approved content and verify publication. We retain account identifiers, approved text and media, scheduling and approval records, publication identifiers and links, and limited operational records. Credentials are stored separately with restricted access. This publishing workflow does not import followers, direct messages or comments. Records are used to operate, secure and reconcile publishing, including preventing duplicate posts, and retained while needed for those purposes or applicable obligations. See the deletion instructions below for requests and recovery-copy limitations.
For the Things Space Meta integration, see our data deletion instructions. These explain disconnecting authorization and requesting deletion of information held by Things Space.
Digital-product delivery acknowledgements
For products that need a UK/EU immediate-delivery acknowledgement, we record the product, exact wording and version, country decision, and time of your choice before checkout. A local country lookup is approximate; unknown locations are asked for a purchase country. We do not save your raw IP address in this acknowledgement record or use it for advertising. A random checkout reference is sent to Payhip as order metadata. After an associated purchase notification, the order reference and purchase email are used to confirm your acknowledgement. Unmatched checkout records expire after 24 hours; records linked to an order are retained with purchase records as needed to handle delivery, refunds, disputes and applicable legal recordkeeping. This is not newsletter consent or a waiver of rights for faulty content.