Privacy Policy
Small Secret Shelf is operated by an individual seller based in Estonia. This policy explains how personal data is handled when you visit, purchase, or use your Secret Drawer.
Data we process
- Email address and Paddle customer identifier.
- Transaction identifier, purchased item, amount, currency, and purchase time.
- Secret Drawer contents and server-generated surprise results.
- Optional Transmutation feedback: the product surrendered, the reason selected, and any optional short note you choose to submit. We use this information to improve the shop and administer a requested exchange; it is not a diagnosis.
- Hashed login tokens, session records, and limited security or service logs.
- Basic browser storage needed to keep you signed in and preserve the experience.
- Newsletter email address, consent date, confirmation status, and unsubscribe status when you choose to join Shelf news.
We do not receive or store your full payment-card details. Paddle processes payment information.
Comfort Corner and Daily Comfort Keys
Comfort Corner offers optional reflective experiences. To deliver a free Daily Comfort Key or a paid experience, we keep your verified email, the digital product you unlocked, whether it was free or purchased, and (for free claims) the UTC claim date. This can reveal personal interests or circumstances, so we treat the information as private. We do not ask you to disclose a diagnosis, and the answers or reflections you make while reading the ten approaches are not sent to our servers. Limited hashed connection data may be kept temporarily to prevent sign-in-link abuse. A Comfort account does not subscribe you to marketing; Shelf news still requires separate confirmation and consent. You can contact us about access or deletion, subject to applicable legal requirements.
Aggregate discovery statistics
We count public Comfort page views and exploration clicks in daily totals. Counters do not record the selected mood, collection, email, personal answers or a visitor identifier. We also count recognised AI/search referral sources when the browser provides them. Counts are events, not unique people or guaranteed search attribution.
Why we process it
We use data to complete purchases, provide permanent access to purchased items, authenticate Secret Drawer access, send requested login and purchase emails, send Shelf news only after your confirmation, manage unsubscribes, prevent fraud and duplicate processing, secure and maintain the service, and meet legal obligations.
Legal bases
Depending on the activity, processing is necessary to perform our contract with you, comply with law, or pursue legitimate interests in operating and securing the service. Newsletter messages are based on your consent. You can withdraw that consent at any time using the unsubscribe link in an email.
Service providers
We use Paddle for checkout and merchant-of-record services, Cloudflare for hosting and database infrastructure, and Resend for transactional and consent-based newsletter email. These providers process data under their own terms and privacy commitments.
Retention
Purchase records are retained as needed to provide access and satisfy accounting, tax, fraud-prevention, and legal requirements. Magic links expire after 30 minutes; sessions normally expire after 30 days. Newsletter confirmation links expire after 24 hours. Newsletter subscription and consent records are retained while you remain subscribed and as reasonably needed to demonstrate consent or honor an unsubscribe request. Other records are kept only as long as reasonably necessary.
Cookies and local storage
The site uses functional browser storage for login sessions, drawer continuity, and interface state. We do not currently use advertising cookies or sell personal data.
International processing
Providers may process data outside your country. Where required, they use recognized safeguards for international transfers.
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection, and may complain to your local data-protection authority. We may need to verify your identity before acting on a request.
Children
The service is not directed to children under 16, and we do not knowingly collect their personal data.
Policy changes
We may update this policy as the service or legal requirements change. The date above identifies the current version.
Contact
Questions may be sent to support@smallsecretshelf.com.