Privacy Policy

Who runs this site

Corteiz Community is a personal project run by one person from Spain. There is no company behind it. It is independent of Corteiz, and it earns money in two ways: affiliate commissions on some outbound links and advertising. Neither changes what we publish. See the terms for how that line is drawn.

For anything in this policy, including a request to access or delete your data, write to contact@corteizcommunity.com. That address is the right one for data protection requests; you can also reach us on Instagram at @corteizcommunity, but for anything about your data please use email so there is a record.

What we collect

There are no accounts, no sign-ups and no email lists. You never give us your name, your address or your email. What we do store is the minimum needed to make voting work, to keep the site from being abused, and to know which articles are worth writing:

• A random session identifier. Stored in a first-party cookie (cc_sid) and against your votes, likes and favourites. It is a random string. It is not linked to you, only to the browser you used.
• Your IP address, for sixty seconds. Voting, liking, favouriting, turning on a restock alert and writing to us are all capped per browser and per network, and the network cap needs the address itself. It is held in memory for a minute and expires on its own: it never reaches our database. The anti-bot check on those same actions is sent your address too, because that is how it tells a person from a script; it runs on Cloudflare, and there is more about it below. Two things are worked out from your address and described further down this list: the two-letter country code, and the short-lived fingerprints behind the read and share counters. The address itself is never written down.
• Outbound clicks. When you click a Sell/Buy link we record which marketplace, which product, the session identifier and the browser's user-agent string, so we know which links are worth keeping.
• A two-letter country code. Stored against votes, favourites, outbound clicks, feedback messages, restock-alert subscriptions, article reads and article shares. We keep only the country: no city, no region, no coordinates, and never the IP address itself. A country code is shared by tens of millions of people.
• A count of article reads, by day and by country. Opening a news article adds one to a counter for that article and that day, and one to a counter for that article, that day and that country. This one is deliberately different from everything above: it does not use the cc_sid cookie, sets no cookie of its own, and stores no identifier. To stop a refresh counting twice we keep a short-lived fingerprint of your IP address and browser in memory for thirty minutes; it expires by itself and never reaches our database. From those fingerprints we also work out a third number, an estimate of how many different browsers opened the article that day: a how many, never a who, and only the total is written down, never a list. What survives is three numbers going up (reads per article per day, reads per article per day per country, and that daily estimate) and nothing that says which of them was you.
• A count of shares, by day, by network and by country. When you press one of the share buttons on a news article (the row of them above the picture, the row at the end of the article, or the share window those rows open), we add one to a counter for that article, that day, that network and that country. The buttons are X, WhatsApp, Reddit, Facebook, copy the link and your device's own share menu; the last two exist only inside the window. Same rules as the read counter: no cookie, no identifier, and a fingerprint held for sixty seconds only so that one press is not counted twice. We record that a button was pressed. We never learn whether you went through with it, who you sent it to, or what you wrote.

How we work out the country. First from the country header Cloudflare adds to the requests it passes on, which is the accurate one. When that header does not arrive (the site is sometimes served without going through Cloudflare), we look the address up in a database of IP ranges stored on our own server. That database only maps addresses to countries; it holds no city and no coordinates, there is nothing else in it to find. Your address is not sent to anyone to do this, and it is not written down afterwards. Where neither way can tell (that includes requests arriving over Tor, which hides it on purpose), votes, favourites, outbound clicks, feedback messages and alert subscriptions store nothing rather than guess, and the two counters store XX, which means exactly “not known”.

When the header is there, Cloudflare tells us a request came over Tor and we stop right there. When it is not, we recognise Tor ourselves: the Tor Project publishes the list of its exit relays, we download that list to our own server and check the address against it, before the header and before anything else, so that a country header put on a request by hand cannot get past it. The list is refreshed daily, so a relay that started a few minutes ago may not be on the copy we hold yet. And where the list cannot speak for an address at all (it covers the older kind of internet address, and a request that reaches us over the newer kind without Cloudflare in front is outside it), we store no country for that request rather than risk storing a relay's.

The database is IP Geolocation by DB-IP, published under a Creative Commons Attribution 4.0 licence, which is why it is credited here. We download a fresh copy once a month.

Those counters are the only measurement we keep on our own servers, and what they count is pages and presses. The one that comes closest to counting people is that daily estimate of different browsers, and even it is only a how many: it arrives as a single number per article and day, worked out from fingerprints we never store, so there is no one in it to pick out. They are all stored already added up: a row per article, day and country that goes up by one. Nothing is written per visit, so there is no list of what anyone read, in what order or when. Not for anyone, and not for us either. That is the whole reason for counting this way.

Separately, we look at the traffic statistics Cloudflare already produces as a side effect of delivering the site: requests, bandwidth, cache hits and a breakdown by country, for the site as a whole. We do not add anything to your browser to produce them and we cannot single anyone out from them: what we receive is already aggregated into totals. This is the same data any site owner can see about their own server logs.

We also use Google Analytics, which is a visitor-tracking product and does set cookies. It only stores anything in your browser if you accept analytics cookies. Decline, and it sets no cookie and creates no identifier. What it is for, and what it is not, is explained under Google Analytics below.

Third parties

Cloudflare

The site sits behind Cloudflare, which handles delivery and security. Cloudflare processes the IP address of every request. We also use Cloudflare Turnstile, an anti-bot check that runs when you vote, like or favourite something; it replaces the kind of captcha that makes you label traffic lights, and it sets its own cookies.

We also switched on Cloudflare Web Analytics, which measures how fast pages actually load for real visitors: the numbers Google uses for ranking. Unlike Google Analytics it is cookieless: it stores nothing in your browser, creates no identifier and cannot follow you between visits or across sites. It runs for everyone, without asking, because there is nothing to ask about. But you should know it is there.

Google Analytics

We use Google Analytics 4 to understand how many people actually reach the site and which pages are worth writing more of. Being honest about the trade-off: this is third-party tracking, it sets cookies, and Google is the one processing it.

It is loaded through Google Tag Manager, which is a container that decides which measurement code runs. Tag Manager sets no cookies of its own and collects nothing by itself; it is plumbing, and everything it loads is listed on this page and on the cookie page.

• Nothing is stored until you say yes. Analytics storage is denied by default. Nothing is stored in your browser and no identifier is created unless you accept analytics cookies, and you can withdraw that at any time on the cookie page.
• What it records: pages viewed, how you arrived (a search engine, a link from another site, or directly), approximate location, which can be as precise as the city you are in, and device and browser type. We do not send it your name, your email, or anything you type into the site.
• When you vote. Once our server has saved a vote, the page also passes Analytics a vote event: which item (its number, name and season), whether the vote is up or down, and the kind of page you voted from (the home page, a collection, a product page and so on). It follows the same cookie choice as everything else Analytics records.
• It can be used for advertising. If you accept, Google may use what it collects here to build advertising audiences and to personalise the ads you are shown, here and on other sites. If you decline, it does not: we tell Google to serve non-personalised ads only, and you can change your mind at any time on the cookie page.
• Our own records are not handed over. The vote event carries nothing that ties it to the vote we keep: not your cc_sid cookie, which is ours and never leaves our servers, and not the country code we store. Your favourites, restock alerts, article reads and shares are not sent to Google at all.
• Why we turned it on: the traffic figures Cloudflare gives us count every request, including bots and our own servers, so they say very little about real readers. If the site ever carries ads beyond AdSense, an advertising network will ask to see this data.

Advertising

Google AdSense is configured on this site for verification:

• Google and its partners may use cookies and similar technologies to serve ads based on your prior visits to this and other sites.
• You can opt out of personalised advertising at Google Ads Settings, or opt out of third-party vendors at aboutads.info.
• If you are in the EEA or the UK, you will be asked for consent before any advertising cookie is set, and you can change or withdraw that choice at any time on the cookie page.

See our cookie policy for the full list.

Affiliate links

Some Sell/Buy links are affiliate links. If you buy something after following one, we may earn a commission at no extra cost to you. It never changes the price you pay and it never changes which marketplaces we list. That is decided by whether they authenticate what they sell.

Where the product data comes from

Prices, sizes, release dates and sellout times are collected from publicly available pages on corteiz.com and stored on our own servers. No personal data is involved. Images are copied to our own hosting so the archive survives when a product is withdrawn.

If you turn on restock alerts

Restock alerts are optional and off unless you switch them on. There is no account and no email. But turning them on does mean we store something that identifies your device, and you should know exactly what.

When you allow notifications, your browser asks Google, Apple or Mozilla (whichever runs push for it) for a unique address it can be reached at. We store that address, plus the two keys the browser generates so that only your device can decrypt what we send. That address is a persistent unique identifier for that browser on that device, so we treat it as personal data even though it carries no name.

We also store 120 characters of your browser's user-agent string, only to tell whether a delivery failure is specific to one browser, and the two-letter country code worked out as described above. Never over Tor, and never the address it came from. Nothing else.

Alerts cover three things: the sizes you put a bell on, new drops landing, and the articles we publish (a few a month). All three are on when you turn notifications on (your browser grants one permission, not one per kind), and the drop and article ones can each be switched off on their own from the alerts panel.

Then there is what you ask to be told about: the products and sizes you put a bell on, and any standing rules you add (a category, a size, and how many alerts an hour you are willing to get from it). That list is what the alert is for, so we have to keep it, and it sits against the same anonymous session as everything else. It is never used to build a profile, to recommend anything, or for advertising, and it goes when you remove the entries or turn alerts off.

The alerts live in that browser. They are tied to the anonymous session cookie you already have, so they do not follow you to another device or another browser. And if you clear this site's data, they are gone and you will need to turn them on again.

You can switch them off from the alerts panel on the restocks page, which deletes the address immediately. Revoking the notification permission in your browser settings has the same effect from your side; we also delete an address the first time the push service tells us it is dead.

If you write to us

The feedback form stores what you type and your email address, which is required so that we can reply. We also record which page you came from, your country code, and a salted, one-way fingerprint of your network address. The fingerprint exists to stop someone flooding the form; it cannot be turned back into an address, and no address is stored.

We do not use your email for anything except replying to that message. It is never added to a mailing list, never shared and never sold.

Our Instagram account

We publish drop and restock announcements to our own Instagram account through Meta’s Instagram API. It is worth being precise about what that does and does not involve, because “connected to Instagram” sounds broader than it is.

• It only writes, never reads. The connection is used to post images we generate ourselves from public product data. We do not read followers, comments, direct messages, likes or profiles, and we hold no permission that would let us.
• It collects nothing about you. If you follow us or see a post, we receive no personal data about you from Instagram. What Instagram itself collects when you use Instagram is covered by their own policy, not by this one.
• Nothing you do on this site is sent there. Your votes, favourites and alerts are never sent to Instagram or Meta. The images we publish contain product names, sizes and prices. Never anything about a visitor.
• The access token lives on our server only. It is held in a restricted secrets store, never in the site’s code and never in your browser.

How long we keep things

• Votes and favourites: for as long as the archive exists. They are the archive.
• Outbound click records: 24 months. A job runs every night and deletes anything older; this is enforced automatically, not by hand.
• Article read and share counts: they belong to the article and last as long as it does. When an article is deleted for good, the database removes its counters in the same operation. They are totals, not a record of any visit, so there is nothing in them to delete on request. There is no row that is yours.
• Session cookie: 12 months from your last visit, unless you clear it first.
• Feedback messages and the email address sent with them: 12 months. The same nightly job deletes them; you do not have to ask.
• Restock alert subscriptions: 12 months from the last time we used one. Still using the site keeps yours alive; stop, and it is deleted.
• What you are watching, and your standing rules: they go with the subscription. Turning alerts off, or the subscription expiring, takes them with it. There is no point keeping a watch list for a device we can no longer reach.
• The record of which alerts we sent you: 3 months. We keep it so the same restock is never sent twice and so a failure can be traced; past that it answers no question worth asking. It goes immediately if the subscription does.

Deleting your data

Meta requires apps to publish deletion instructions, so here they are in one place. Most of what this site holds is not tied to a name, so deleting is simpler than usual.

• Our Instagram app holds nothing about you. It only posts images to our own account. There is no account, profile or record of you on our side to delete, and nothing to ask us for.
• Votes and favourites live under the cc_sid cookie. Clearing your browser’s cookies for this site detaches them from you for good: we hold no name or email to reconnect them.
• Restock alerts stop and are deleted the moment you turn them off, on the restocks page or in your browser’s notification settings.
• Anything else (a feedback message, an email address you sent us): write to contact@corteizcommunity.com and it is removed. No form, no account, no proof of identity we could not already see.

Your rights

Under the GDPR you can ask for access to, correction of, or deletion of your data. There are only two things we hold that count as personal data, and both are optional: the email address you send with a feedback message, and, if you turned on restock alerts, the push address of your browser. Write to us from that email and we will delete the message; switch the alerts off and the address goes immediately. For everything else we hold no name and no email, so the only way we can find your records is the session identifier in your cc_sid cookie. Send it to contact@corteizcommunity.com and we will delete everything attached to it. You also have the right to complain to your national data protection authority; in Spain that is the AEPD.

Clearing your cookies for this site removes the link between you and anything stored, with no request needed. The country code stays on the record, because on its own it points to no one. The read and share counters are not affected either way: they were never attached to your cookie, and there is no row in them to detach.

Children

This site is not directed at children under 13 and we do not knowingly collect data from them.

Takedowns

If you represent a rights holder and want something removed, write to contact@corteizcommunity.com and we will take it down. We are not trying to compete with anyone; this is an archive built by people who buy the clothes.

Changes

If this policy changes, the date at the top changes with it. Anything that affects what we collect will be announced on the site before it takes effect.