Privacy & Browser Storage

This notice describes the current Royal Onyx site operated by Royal Onyx LLC, a Florida-based store in pre-launch review. It was reviewed on September 7, 2026. Online payment and new newsletter enrollment are disabled. The Contact page is the current on-site way to send a privacy question; do not include payment-card details, identity documents or other sensitive information in a message.

Information you provide

The contact form stores the name you choose to provide, email address, subject, message, a received timestamp and an internal handled status. Name and subject are optional. Messages are read in the restricted admin area; the form does not automatically send an email to staff. Previously submitted newsletter records contain an email address, record identifier and signup date. There is no automated marketing delivery or unsubscribe service, and new signups are paused. We do not create customer accounts or collect card numbers, billing or shipping addresses through a checkout in this version. A message may contain order details if you choose to include them.

Hosting and security

The site is built to use Cloudflare hosting, D1 storage and R2 media storage. Development records currently remain in a local database. When hosted, Cloudflare would process requests and stored data for service delivery and security. Network requests necessarily expose technical information such as IP address, requested URL and browser/network details to the receiving service. Server diagnostics may record requests and errors. We use these systems to operate the site, respond to inquiries and investigate misuse, not to run an advertising profile.

When enabled, Cloudflare Turnstile checks form submissions for abuse; verification receives a challenge token and may receive the connecting IP address. No Turnstile widget is configured in the present local version. Cloudflare Access is used by the production admin authentication design, not as a customer account. Cloudflare's privacy policy and Turnstile Privacy Addendum explain its own processing. Provider configuration and retention must be reviewed before public hosting.

Cookies and browser storage

The shopping bag uses a localStorage entry named royal-onyx-cart-v1. It contains product identifiers, descriptions, prices, image references and quantities and persists until removed or the bag is changed. The bag page sends product slugs to our own server to check catalog details. A restricted administrator's theme preview uses the ro_theme_draft session cookie; it is not a marketing cookie. No application sessionStorage use, advertising pixel, analytics tag or social-media embed was found in this version. Future Cloudflare security/authentication configuration may add functional cookies.

Your browser also requests selected fonts from Google Fonts and sends the network information needed to obtain them. This external font request is distinct from an analytics tag and is not evidence that no third party receives data. We have not added a cookie consent banner for advertising or analytics because those tools are not installed. If we add nonessential tracking or expand to jurisdictions that require consent, we must update the notice and implement applicable controls before enabling it.

Use and sharing

We use submitted information to respond to your inquiry, administer requests and protect the site. We may disclose relevant information to service providers supporting those functions, professional advisers, or authorities where legally required. A future transaction or dispute may require relevant evidence to be shared with its payment provider or carrier; no payment processor is currently integrated. This application has no data-sale, cross-context advertising or third-party marketing-list integration. These statements do not mean that hosting and font providers receive no data.

Retention and security

The current application has no automatic deletion schedule. Contact messages and existing newsletter records remain until manually removed or otherwise administered. Access controls, server-side validation and restricted storage help protect them, but no system can promise absolute security. Before launch, the owner must approve and implement a retention schedule based on actual support, tax, dispute and legal needs, including backups. We will not promise a fixed deletion period that the current system does not enforce.

Choices and requests

You can clear browser storage to remove the local bag; this may reset its contents. You can choose not to send a contact message. To ask about access, correction or deletion of information already submitted, use the Contact page and describe your request without sending sensitive documents. Reasonable verification may be necessary to avoid disclosing data to another person. Requests are handled manually and subject to applicable retention obligations. Any rights and response deadlines imposed by a law that applies to you remain available; we do not represent that every state privacy statute applies to every visitor or business. This version does not change behavior in response to Do Not Track signals and has no sale/sharing advertising feature for a Global Privacy Control signal to disable.

Children and changes

The site is intended for a general audience, not children under 13. Do not send a child's information through the form. If a parent believes a child has submitted personal information, contact us so it can be reviewed and removed where appropriate. Material changes to collection or providers will require an updated notice with its review date and any additional notice or consent required by law.