How to Order a Microneedling Device Privately

To deliver a microneedling pen, a store needs four things from you: your name, a delivery address, a way to take payment and a way to send you the tracking number. Everything past that is optional, and the stores we have reviewed differ a lot in what they do with it. Two of them run privacy policies that are unfinished templates, one says it shares your purchases with advertising partners, and one says it uses no analytics at all. You can’t make an order anonymous, and you shouldn’t try to: the payment and the parcel both have to reach a real person. What you can do is pick the store, the payment method and the delivery option that hand the fewest extra details to the fewest companies.

What the sellers we reviewed do with your data

This table comes from the privacy policies cited in each review, all read on October 6, 2026.

Seller (review) What the policy says What stands out
Dr. Pen US, us.drpen.co (M8, M8S, A6S, A11, A20) Shares “your use of the Site, your purchases, and your interaction with our ads” with advertising partners; names Shopify, Google Analytics, Facebook, Instagram and Pinterest. Data is “initially processed in Ireland”. Keeps order data “unless and until you ask us to erase this information.” A Shopify template that still contains “[INSERT OTHER COOKIES OR TRACKING TECHNOLOGIES THAT YOU USE]”. The A20 pages also ask for a business name, license number and name on license, which the policy never mentions.
drpenofficial.com (A10, X5 and A7, Hydra Pen) Shares data “With business and marketing partners to provide marketing services and advertise to you.” Retention “depends on different factors”. The current Shopify template, filled in, with no placeholders.
Korabeauticals (V2) An unfilled template: “Last updated: [DATE]”, a contact email of “[email address]” and more than 20 bracketed instructions. Its California section reads “Our Site sells Personal Information”, followed by placeholders where the categories sold and the opt-out instructions should be.
DermapenWorld US (Dermapen 4, Dermapen HOME) Contradicts itself on cards: card details are “never taken by us” in one paragraph, and a later heading reads “We retain your credit card information securely”. The HOME has to be registered in an app before setup. Its App Store label, which Apple has not verified, lists name, email, physical address, user ID and device ID as linked to your identity.
Derminator, owndoc.com (Derminator 2) “We do not use analytics.” Order data sits on “a managed server for us alone”. “Our site never gets to know your card number.” Says nothing about how long data is kept or how to ask for deletion.
SkinPen (review) Unread: both linked policies (Revance’s general and health-data policies) returned HTTP 429 to our requests. Unknown, which is different from bad.

None of these stores had a documented data incident when the reviews were written. The table compares what each one says it does, not what it has been caught doing.

The same pen can come from several stores under different policies. The Dr. Pen M8, for example, is sold on us.drpen.co and on other sites using the Dr. Pen name, and the M8 review could not confirm which of them, if any, is the maker’s own US channel. Choosing the store is the first privacy decision, and it often decides more than the payment method does. Buyers on Reddit run into the same question from the authenticity side, as in a thread titled “Has anybody purchased this product?”, whose snippet asks whether an Amazon listing “is the real thing”:

Has anybody purchased this product?
byu/Local-Librarian-6552 inMicroneedling

Read a privacy policy in two minutes

You don’t have to read the whole thing. Open the policy (usually linked in the footer) and search the page for a handful of words.

  1. “sell” and “share”. This is the line that matters most. Dr. Pen US and drpenofficial.com both say they share data for advertising. Korabeauticals’ template says the site “sells Personal Information”.
  2. “advertis”, “partners”, “pixel”. Who gets your browsing and purchase history, and whether the policy names them. Dr. Pen US names five companies.
  3. “retain” or “retention”. How long they keep your order. “Until you ask us to erase” (Dr. Pen US) tells you that you have to ask. “Depends on different factors” (drpenofficial.com) tells you nothing.
  4. A country name, or “transfer”. Where your data is processed. Dr. Pen US says Ireland first, then places including Canada and the United States.
  5. “[” and “Last updated”. A square bracket in a privacy policy is usually a template instruction nobody deleted. A missing or “[DATE]” update line means nobody finished the page.
  6. The operator’s name and address. If the policy doesn’t say who runs the store, find out from the terms or the about page before you pay. drpenofficial.com names its operator only on its about page.

One leftover placeholder and more than twenty are scored differently in our reviews: Dr. Pen US gets 4 for privacy, Korabeauticals 3.

Payment: what each method shows the store

Every method below still gives the store your name and shipping address, because the parcel needs them. What changes is whether the store, and its payment processor, ever hold your real card number.

Credit or debit card typed in. The store’s payment processor receives the real number. Derminator’s policy says its own site never sees it. DermapenWorld’s policy says two opposite things about whether it keeps card details.

Apple Pay. Apple says it sends the website a “Device Account Number” and a “transaction-specific dynamic security code”, and that “Neither Apple nor your device sends your actual payment card number.” Apple also says it doesn’t keep transaction information that can be tied back to you when you pay with a credit, debit or prepaid card.

Google Pay virtual cards. When Chrome autofill pays with a virtual card, the merchant gets “your virtual card number, expiration date, and CVV” instead of the real ones. Google says the feature is only available for “select banks or networks in select countries or regions”.

Your bank’s own virtual numbers. Capital One, for example, issues a 16-digit “token” that “serves as a substitute for your physical card number so the merchant can’t access your real card information”, including merchant-specific numbers you can delete later. Charges still appear on your normal statement. Other banks offer similar features; check your own bank’s page.

Privacy.com-type services. Privacy.com issues virtual cards that can be locked to one merchant, given a spending limit, paused or closed. It says it “will never sell your personal data”. It is not anonymous: signing up requires Know Your Customer identity checks, and it is open to US citizens or legal residents with a US bank or credit union account.

PayPal. The store doesn’t see your card, but PayPal shares data with merchants by default. Its privacy statement says that, unless the law requires consent, it discloses personal information collected after November 27, 2024 “for personalized shopping experiences in the United States”. You can switch this off under Data and Privacy in your PayPal account settings.

Prepaid cards. The Consumer Financial Protection Bureau says that registering a prepaid card means giving the provider “certain personal information to identify who you are”, and that an unregistered card may have fewer protections if it is lost or stolen. The privacy gain is limited to the store not seeing your main card. The protection cost is real.

A single-merchant virtual number has one practical advantage over the rest: if that store’s systems are breached, you close the number and the card behind it keeps working.

Delivery: home, PO box or pickup

A USPS PO Box keeps your home address off the label. USPS also offers Street Addressing at some Post Offices, which lets packages from other carriers (“including Amazon, DHL, FedEx, and UPS”) reach your box, “subject to availability and restrictions”. Without it, a store that ships by a private carrier may not be able to deliver to a PO box at all.

USPS Hold for Pickup keeps a parcel at a Post Office instead of delivering it. It is requested by the sender when postage is bought, so you have to ask the store, and it only works if the store ships with USPS. The person collecting it must show “an acceptable primary form of Identification”. USPS sends a second notice after 5 days and returns the item after 15 (3 and 5 days for Priority Mail Express).

FedEx Hold at Location works the same way at FedEx sites. FedEx asks for “a government-issued photo ID”, plus the tracking number if your name doesn’t match the label.

UPS Access Point and Amazon pickup lockers are other options. Both companies’ pages refused our automated requests, so their terms are unverified here.

Every pickup option asks for ID that matches the name on the label. That’s the point of them: they keep your home address away from the store and off your doorstep, not your name away from the carrier.

Email and marketing

Use a forwarding alias for the order. Apple’s Hide My Email “generates unique, random email addresses that automatically forward to your personal email inbox”, and Firefox Relay’s masks do the same. If one store’s list starts getting spam, you turn off that one address.

Opting out of marketing is backed by law. Under the federal CAN-SPAM Act, a business must honor an unsubscribe request within 10 business days, and it can’t ask for any personal information beyond your email address to do it, according to the FTC’s compliance guide.

California residents have a further right under the CCPA: to tell a business not to sell or share their personal information. The California Attorney General says a browser’s Global Privacy Control signal counts as an opt-out, and names Firefox, DuckDuckGo and Brave as browsers that offer it. Korabeauticals’ policy, which says the site “sells Personal Information”, leaves its opt-out instructions as a placeholder, so the store itself documents no way to opt out.

Account or guest checkout

Choose guest checkout when a store offers it. An account is another stored copy of your name, address and order history, and Dr. Pen US’s policy says it keeps order data until you ask for it to be erased. Our reviews didn’t record which stores allow guest checkout, so check at the cart.

Two cases take the choice away. The Dermapen HOME can’t be set up without registering it in DermapenWorld’s app, and a registered device can’t be returned. The Dr. Pen A20 is a different case altogether. Dr. Pen US sells it as a professional device and asks for a license number and the “Full Name on License” before it can go in the cart. Those fields are a sale restriction, not a privacy setting. If you don’t hold that license, it isn’t a pen the store is selling to you.

If a store you used has a data breach

The FTC’s advice after a breach notice is to change the password for that account and any account that shares it, turn on multi-factor authentication, and check IdentityTheft.gov/databreach for the steps that match what was exposed. If someone has started using your details, report it at IdentityTheft.gov, which gives you a personal recovery plan.

A credit freeze is free, lasts until you lift it, and has to be placed with each of the three bureaus (Equifax, Experian and TransUnion), according to the FTC. If you paid with a merchant-specific virtual number, delete it; Capital One’s help pages, for example, show where to do that.

FAQ

Can I buy a microneedling pen without giving my name? No. The payment and the delivery both need your real name, and pickup points check ID against the label. What you can limit is everything else: your home address, your real card number, your main email and your data being shared for advertising.

Can I ship a microneedling pen to a PO box? Yes, if the store ships with USPS. For packages from other carriers, USPS’s Street Addressing service, where a Post Office offers it, gives the box a street-style address.

Does Apple Pay hide my address from the store? No. Apple Pay replaces your card number with a device-specific one. The store still receives the name and address it needs to ship the parcel.

Which reviewed seller says the least about tracking? Derminator. Its policy states that it uses no analytics and never sees card numbers. It also says nothing about retention or deletion.

Sources

  • Our reviews, which document each seller’s privacy policy, all checked 2026-10-06: /reviews/dr-pen-m8/, /reviews/dr-pen-m8s/, /reviews/dr-pen-a6s/, /reviews/dr-pen-a11/, /reviews/dr-pen-a20/, /reviews/dr-pen-a10-x5-a7/, /reviews/hydra-pen/, /reviews/korabeauticals-v2/, /reviews/dermapen-4/, /reviews/dermapen-home/, /reviews/derminator-2/, /reviews/skinpen/
  • Dr. Pen US, privacy policy (last updated 21 Nov 2025, checked 2026-10-06): https://us.drpen.co/policies/privacy-policy
  • drpenofficial.com, privacy policy (last updated June 15, 2026, checked 2026-10-06): https://drpenofficial.com/policies/privacy-policy
  • korabeauticals.com, privacy policy (checked 2026-10-06): https://korabeauticals.com/policies/privacy-policy
  • DermapenWorld US, privacy policy (checked 2026-10-06): https://www.dermapenworld.com/en-us/privacy-policy
  • Apple App Store, DermapenWorld app and its privacy label (checked 2026-10-06): https://apps.apple.com/us/app/dermapenworld/id1515745889
  • owndoc.com (Derminator), privacy policy (checked 2026-10-06): https://owndoc.com/privacy-policy/
  • Apple, Apple Pay security and privacy overview (checked 2026-10-06): https://support.apple.com/en-us/101554
  • Google Pay Help, Use virtual cards to pay online or in apps (checked 2026-10-06): https://support.google.com/googlepay/answer/11234179?hl=en&co=GENIE.Platform%3DDesktop
  • Capital One Help Center, Using virtual credit cards (checked 2026-10-06): https://www.capitalone.com/help-center/credit-cards/using-virtual-credit-cards/
  • Privacy.com, Virtual cards (checked 2026-10-06): https://www.privacy.com/virtual-card
  • PayPal, Privacy Statement (checked 2026-10-06): https://www.paypal.com/us/legalhub/paypal/privacy-full
  • Consumer Financial Protection Bureau, Why do I need to register my prepaid card? (last reviewed Feb 6, 2024, checked 2026-10-06): https://www.consumerfinance.gov/ask-cfpb/why-do-i-need-to-register-my-prepaid-card-en-439/
  • USPS, Rent a PO Box (checked 2026-10-06): https://www.usps.com/manage/po-boxes.htm
  • USPS FAQ, Hold for Pickup Service (checked 2026-10-06): https://faq.usps.com/articles/Knowledge/Hold-for-Pickup-Service
  • FedEx, Hold at Location (checked 2026-10-06): https://www.fedex.com/en-us/shipping/hold-at-location.html
  • Apple Support, How to use Hide My Email with Sign in with Apple (checked 2026-10-06): https://support.apple.com/en-us/105078
  • Mozilla, Firefox Relay FAQ (checked 2026-10-06): https://relay.firefox.com/faq/
  • Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business (checked 2026-10-06): https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
  • California Attorney General, California Consumer Privacy Act (CCPA) (checked 2026-10-06): https://oag.ca.gov/privacy/ccpa
  • Federal Trade Commission, Have you been affected by a data breach? Read on (checked 2026-10-06): https://consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
  • Federal Trade Commission, What To Know About Identity Theft (checked 2026-10-06): https://consumer.ftc.gov/articles/what-know-about-identity-theft
  • Federal Trade Commission, Credit Freezes and Fraud Alerts (checked 2026-10-06): https://consumer.ftc.gov/articles/credit-freezes-and-fraud-alerts
  • IdentityTheft.gov, data breach guidance (checked 2026-10-06; page content loads by script and was read via the FTC alert above): https://www.identitytheft.gov/databreach