The short version: we collect what we need to sell you flour and email you about it, and we use Google Analytics to see how people find and use the site. We never sell your data.

What we collect

When you order: your name, email, shipping address, phone (optional), and what you bought. Payment is handled by Shopify — we never see your card number.

When you sign up for the 10% code or updates: your email, your first name if you gave it, which bag size you were interested in, and which page you were on. If you save a result from the protein calculator, we also store the daily protein target it worked out for you (a grams-per-day figure); the homepage calculator stores the goal you picked alongside it. Your age, weight, height and sex are never stored and never sent to analytics.

On this site: a few values in your browser's local storage: your cookie choice (accepted or declined), the country we detected or you picked for shipping, the contents of your bag so it survives between visits, and flags that stop us showing you the same popup or sign-up box twice. They stay in your browser; clearing site data removes them.

Where you are (country only): when you first arrive, the site asks ipapi.co which country your IP address is in. We use the country, and nothing more precise, to pick your shipping region (US or Canada) and to decide whether the advertising pixels below need your consent before they switch on. The answer is kept in your browser's local storage for a week so we don't ask on every page; ipapi.co sees your IP address under its own privacy policy.

Analytics

We use Google Analytics 4 to understand how people find and use the site. It records the pages you view, your approximate location (city-level, worked out from your IP address), your device and browser, where you came from (a search, a link, a social post), and product interactions — viewing a bag size, adding to your bag, starting checkout. It sets cookies to tell one visit from the next. It's Google's tool and runs under Google's privacy policy. We have Google's advertising features ("Google signals") switched off and keep the data for 14 months.

Advertising pixels

We use the Meta Pixel (Facebook and Instagram), and may use the TikTok Pixel, so we can show Atta Boys ads to people who visited the site, looked at a bag size, or added one to their bag, and so we can measure whether those ads led to an order. They record the same kinds of interactions as Analytics, set their own cookies, and share that data with Meta and, when it's on, TikTok under Meta's privacy policy and TikTok's privacy policy. Each event carries an anonymous id so the same action isn't counted twice. On this site we don't send names, emails, addresses, or anything about your health; checkout is different, see below.

In regions that require consent for advertising cookies (the EEA, UK, Switzerland, and Quebec) these pixels are off unless you switch them on.

Opting out: block or clear cookies in your browser, use a content blocker, install Google's Analytics opt-out add-on, or adjust your ad preferences at Meta and TikTok. The site works the same either way.

Cookie choices

A small bar at the bottom of the site lets you choose. In the EU, UK, Switzerland and Quebec nothing marketing-related switches on until you accept; everywhere else analytics and the advertising pixels are on by default and you can decline. Your choice is stored in your browser, and the Your privacy choices link in the footer of the shop, guide and calculator pages reopens it any time. We also honour the browser Global Privacy Control signal as a decline. Declining doesn't affect ordering.

Checkout

Checkout happens on Shopify, at shop.attaboys.com. Shopify collects the details needed to charge and fulfil your order — name, address, email, payment — under Shopify's privacy policy. Two measurement tools run there: our Google Analytics purchase pixel, which records that a purchase happened and what was bought (not your card details), and Shopify's Facebook & Instagram integration, which runs the Meta pixel on the checkout pages and Meta's Conversions API from Shopify's servers. That integration sends order events to Meta with customer details (such as email, name, phone and address) hashed before they leave Shopify, at the data-sharing level set in our Shopify settings. Your cookie choice on this site applies to our own pixels; Shopify's checkout follows Shopify's own consent handling.

What we do with it

Fulfil and ship your order, send order and shipping emails, answer support, and — if you signed up for it — send occasional Atta Boys email. No spam, dadi's honor. We never sell, rent, or trade your data.

Who else touches it

Only the services that make the store run: Shopify (checkout, payments, order emails), the carrier delivering your bag (USPS in the US, Canada Post in Canada), Google Firebase (US) for the signup list and this site, ipapi.co for the country lookup, and Google Analytics, Meta, and (if it's on) TikTok as described above. Each under their standard security terms.

Unsubscribe anytime

Every marketing email has an unsubscribe link that works. Or just write to us and we'll take you off the list, no questions asked. Order and shipping emails still go out for orders you place.

Your rights

Email us to see, correct, or delete your data and we'll do it. Texas residents: the Texas Data Privacy and Security Act gives you rights to access, correction, deletion, and portability — same email, we'll honor them.

Contact

Questions, deletions, anything: hello@attaboys.com

Last updated September 21, 2026.