Privacy, on the record.

Card details are collected and processed on Stripe-hosted Checkout. The Button Office does not ask you to enter card numbers into its own name or message form.

The backend keeps the payment-session and provider references needed to verify authorization, capture the exact posted USD price, finalize one receipt, prevent duplicates, and reconcile payment incidents. A payment-attempt record also stores the submitted display name and message, including when the attempt does not finalize. An unfinalized attempt does not create or publish a public receipt.

A finalized purchase creates a permanent public record. Its filing number, amount paid, next price caused, submitted public name or alias, submitted public message, filing time, and any threshold stamp may be shown on the site and in receipt images.

Do not submit private or sensitive information as a public name or message. Presentation may later be corrected, redacted, or hidden under the moderation policy, but the underlying price ladder and receipt identity remain permanent.

When someone requests a share link, the backend creates or reuses an opaque attribution token for that receipt. A qualifying top-level visit through that exact link increments a public visit count and records first and last visit times.

The count is visits, not unique people. Repeat qualifying visits can count again. This attribution system does not store an IP address, cookie identity, browser fingerprint, User-Agent, or Referer, and it does not affect price, payment priority, or receipt rank.

After a qualifying shared-receipt visit is recorded, it may also carry a signed receipt-source context into that browser session. It contains only the public source receipt number, a 30-minute expiry, and a random landing value. It contains no user identity and is not a persistent tracking identity. The share token is removed from the receipt URL; the temporary handoff fragment is removed when the page loads.

If you deliberately continue from that receipt to the purchase form, the context may be associated with the newly created payment attempt. It does not reserve a price or affect payment priority. Only an authoritative finalized receipt makes the relationship public as a filing that arrived through the earlier receipt. Visits, authorizations, canceled attempts, and lost price races do not count as purchases.

The recorded relationship remains internally permanent, including after a later refund or dispute. Public source links and follow-on counts respect current receipt visibility; hiding a receipt suppresses its public lineage, and restoring it permits that lineage to appear again.

Local storage remembers an explicit Light or Dark theme choice. Session storage keeps a checkout request key for repeated checkout creation and records the last payment-attempt token before redirect. The payment-result page resumes from the attempt token in its return URL; browser storage is never payment authority.

Session storage may also hold the transient receipt-source context and the local time it arrived. The backend enforces its 30-minute expiry; browser cleanup measures time since arrival so a wrong device clock does not reject fresh context. It remains available for deliberate retries from the same receipt, including after a price change or lost race, until cleanup, a finalized purchase, or direct purchase entry clears it. It is scoped to the browser session, with no attribution identity cookie or persistent local-storage tracking value. A missing, invalid, expired, or unavailable context leaves ordinary purchasing available without lineage credit.

The site does not add advertising pixels, fingerprinting, or a general-purpose marketing analytics SDK.

Visible public receipt pages may be indexed and discovered through search engines, and production includes them in its sitemap. Hidden receipts are excluded from the production sitemap and public presentation.

The Request record attention form on a receipt page sends the receipt number and clean receipt URL, request type, buyer-association statement, email address, details, optional subject, and anti-spam field directly to Formspree.

That submission is an intake message. It does not automatically change a receipt or create a record in the MTBME database. An authenticated operator reviews any later correction, redaction, restoration, or hiding action.