Privacy

This is the complete list, taken from the database rather than from memory.

If you have an account: your email address, and a name if you gave one. Your password is never stored by this site — it is held, hashed, by our authentication provider, and this application never sees it.

If you have ordered: the order itself — its number, the lots, the price each was sold at, the totals, the delivery address you gave, the postage method, any tracking number, and the times at which it was placed, paid and sent. Payments record the method, the amount and the provider’s reference.

Card details: none. No card number ever reaches this site. Payment is taken by the provider you choose at checkout, on their own systems.

In your browser, not with us: your cart, your saved items and your saved searches are kept in your own browser’s storage. They are not sent to us and we cannot see them. Clearing your browser data clears them.

To sell you something and send it to you. The address is needed to post the parcel; the email address to reach you about the order and tell you when it ships; the record of what was sold at what price to keep an account of the sale, which a dealer is obliged to keep.

There is no advertising here, no profiling, and nothing is sold or passed to anyone except the parties needed to complete your order — the payment provider you chose, and the postal or courier service carrying the parcel.

An account lasts until you ask for it to be deleted. Orders outlive the account: deleting an account detaches it from its orders rather than erasing them, because a record of a completed sale is something both sides may need years later, and tax rules generally require it.

An order record is kept for 5 years from the date of the order, which is what the tax rules where the company is registered require of it. After that it is deleted. What is kept is the order itself — the lots, the amounts, the address it went to and the dates — and not a browsing history: we never had one.

You can ask for a copy of what is held about you, ask for a correction, or ask for your account to be deleted. Your order history is visible to you at any time in your account.

Those requests go to info@rarecorner.com, and a person answers them. One thing we cannot do is delete an order record before the retention period above runs out — that is the one piece we are required to keep.

If you are in the United Kingdom or the European Union: Victorgg LLC is established in the United States and has no establishment in the UK or the EU, so there is no lead supervisory authority here to name. You can complain to the data protection authority of the country you live in, and you do not need our agreement to do it.

Four, all of them strictly functional, all marked HttpOnly — which means no script on the page can read them — and none of them used to recognise you anywhere else.

• saaphil_shop holds your session, so the site knows it is you between pages. It is set when you sign in and removed when you sign out. It is the only one that lasts, and the only one sent on every page.
• rc_pkce is set the moment you choose to continue with Google — before you are signed in — and holds the one-time secret that proves the answer coming back from Google belongs to the attempt you started, plus the page you were on so you are returned to it. Ten minutes.
• rc_confirm does the same for the link in a confirm-your-account email, and likewise holds where you were going. One day, because that email is opened when you next look at your inbox.
• rc_recover does the same for a password-reset link. One hour. Asking for a new password does not sign you in, so this one exists without any session at all.

The last three are scoped to /account, so your browser does not send them while you look at the catalogue, and each is deleted as soon as its link has been used or has lapsed. No consent is asked for any of the four because none of them is a choice: without them you cannot sign in, and they do nothing else.

There are no advertising cookies, and Google Analytics is built but switched off: no measurement script of theirs is loaded, no request is made to one, and the content security policy for this site does not permit either. This page says so now rather than after the fact, as it promised.

One thing does count visits, and it is on in both cases: Cloudflare Web Analytics. It records that a page was looked at, and roughly from where and in which browser. It is asked for no consent because it stores nothing to consent to: it sets no cookie, writes nothing into your browser, and builds no identifier that follows you from one site to another — so there is nothing of yours kept here or there to later recognise you by.

The site runs on Cloudflare. The database and the account system are Supabase. Email is sent through Resend. Payment is settled with the provider you choose at checkout, directly between you and them — no card number, bank detail or payment credential ever reaches this site. Each holds only what it needs to do its part.

Your order records, your account and the mailing list are stored in the United States. The site itself is served from Cloudflare’s global network, so the page you are reading was probably delivered by a datacentre near you — but the records behind it were not moved there. If you are buying from the UK or the EU, that means your data is transferred to the United States when you place an order.