Effective date: [DECISION LD-13: effective date]
About this policy
This policy explains the cookies and similar browser storage used on the Coveted Collection website and client portal (the "Portal"), which is operated by [DECISION LD-01: legal entity name and type].
A cookie is a small file a website places in your browser. Browser storage (session storage and local storage) works in a similar way, and we cover it here too.
[DECISION LD-21: confirm this list against a scan of the deployed site before publication]
Essential cookies and storage
These are needed for the Portal to work and to keep it secure. The Portal cannot work without them.
Authentication and session cookies
Our authentication provider, Clerk, sets cookies that sign you in, keep your session active and protect it. These are set by Clerk; the exact list is to be confirmed against the deployed site. They are expected to include:
- __session
- __client_uat
- __refresh
- __clerk_handshake
- __clerk_handshake_nonce
- __clerk_redirect_count
Clerk may also use browser storage. [DECISION LD-21: final Clerk cookie and storage list]
Cookie preference cookie
If you save a choice in Privacy/Cookie Settings, we keep it in a cookie named cc_consent, so we can respect it on your next visit. It holds your choice, the policy version, whether Global Privacy Control was on, and the time.
Staff-only cookies
Three short-lived security cookies are used by staff when connecting to eBay's test environment. They are not set for clients. They last 10 minutes, are not available to page scripts, and are sent only to our staff eBay functions:
- cvtd_ebay_oauth
- cvtd_ebay_listing_oauth
- cvtd_ebay_finances_oauth
Session storage
Session storage is kept for the browser tab you are using and ends when the tab closes.
- Account activation. Holds your invitation secret while you finish signing up, and is removed once activation ends.
- Client access. Holds the time of an attempt to open your client account, so the page does not retry repeatedly.
- Submission form. Holds the values of a submission you are sending, so it is not sent twice.
- Staff eBay tools. Hold the action in progress while connecting to eBay's test environment.
Local storage
Local storage stays on the device until it is cleared. Staff use it for their own device settings: camera lens, zoom, capture mode and camera rotation, and the last batch they reviewed. The application does not use it for client preferences.
We do not use cookies to remember which client account you selected. That is held on our servers and linked to your session.
Optional analytics and marketing cookies
None are in use. We do not use analytics, marketing or advertising cookies, tracking pixels or similar technologies.
If that changes, we will update this policy first and will ask for your choice where required. [DECISION LD-21: consent model for any future optional cookies] [DECISION LD-19: any marketing technology]
Providers and purposes
- Clerk: sign-in, session security and multi-factor authentication. Clerk's script runs on the pages where you sign in or activate your account, and may run on other Portal pages.
- Coveted Collection: the application's own storage listed above.
Fonts are served from our own website, so loading them does not contact Google from your browser. Our hosting provider, Vercel, handles web requests. [DECISION LD-21: confirm whether Vercel sets any cookie on the production site]
Retention and expiration
- Clerk cookies: [DECISION LD-21: Clerk cookie durations, once confirmed against the deployed site]
- Staff eBay security cookies: 10 minutes.
- Session storage: until the tab closes, or sooner where stated above.
- Local storage: until cleared by the device's user.
- cc_consent cookie: [DECISION LD-21: cc_consent cookie duration]
- Records of choices made while signed in: [DECISION LD-06: retention period]
Consent and preference controls
You can review your choices at Privacy/Cookie Settings.
Essential cookies and storage do not depend on consent, because the Portal cannot work without them. [DECISION LD-21: confirm this approach for each launch jurisdiction]
Global Privacy Control. We honour the Global Privacy Control signal. When your browser sends it, we treat it as a choice to opt out of any optional cookies and of any sale or sharing of personal information. [DECISION LD-20: how the signal is applied]
[DECISION LD-17: whether cookie choices made while signed out are logged]
[DECISION LD-31: confirm the settings page and Global Privacy Control handling are live before publication]
How to withdraw consent
You can change or withdraw a choice at any time at Privacy/Cookie Settings. You can also turn on Global Privacy Control in your browser, or clear or block cookies in your browser settings.
Blocking essential cookies will stop you from signing in to the Portal.
Changes to this policy
Each version has a version number and effective date. [DECISION LD-13: what counts as a material update, and how notice is given]
Contact
Questions about this policy: [DECISION LD-18: privacy contact address]
Legal entity and address: [DECISION LD-01: legal entity name and postal address]