Privacy policy

Corner Lab uses cookieless analytics — Cloudflare Web Analytics and Ahrefs Web Analytics — for aggregate traffic (which pages are visited, in broad terms) — not who you are, not what you clicked inside a page, and not a cross-site profile. We set no tracking cookies and run no advertising. If you hold an account we store your email address, your membership status and Polar's reference for your payments — nothing about what you read or how you drive. Payments are handled by Polar, and card details never reach us. That is the whole policy; the rest is detail.

Last updated 17 October 2026.

Who is responsible

Corner Lab is operated by Corner Lab DFA Technologies Ltd, a company incorporated in British Columbia, Canada, which is the data controller for the purposes of the UK and EU GDPR, and under Canada's PIPEDA and British Columbia's PIPA. For anything in this policy, including a request about your own data, write to privacy@cornerlab.ca.

What this site collects

Without an account: almost nothing identifiable. Reading this site involves no sign-up, no contact form, no comments and no newsletter. The pages are static; we do not store what you read or build a history of your visits on our systems, and we do not use localStorage or similar on-device storage for visitors who are not signed in.

Traffic measurement. Cloudflare Web Analytics is enabled in our Cloudflare dashboard. It uses a small script Cloudflare may inject when a page is served; it does not set cookies and does not receive your name or email. It gives us aggregate counts so we know whether anyone is using the site. Cloudflare processes this as our processor; see Cloudflare Web Analytics and their privacy policy linked below.

Ahrefs Web Analytics does the same job the same way, and its script is written into our pages rather than added by the host. It does not set cookies and does not collect personal data; it derives a country and city from your IP address and discards the address — the raw address is never stored. It gives us the same aggregate counts, and Ahrefs processes this as our processor; see Ahrefs Web Analytics.

With an account: your email address, your membership status and a payment reference. The status is whether a membership is active and which tier it is — there is one paid tier today, so that is a single word either way. The reference is the customer id Polar gives us, so a payment can be matched to your account, and the record notes when it was created and last changed. That is the entire record. No lap times, no telemetry, no setups, no reading history — we do not store what you look at, so we could not hand it over or lose it.

Two cookies, and only if you sign in. The session cookie holds a random token and nothing else — no name, no email, nothing a script can read. It is the mechanism that keeps you signed in, and it is built to be the safest version of that: HttpOnly, so no script on the page can read it; Secure, so it never travels unencrypted; SameSite=Lax, so another site cannot use it to act as you. It lasts seven days, and signing out deletes it.

The second cookie holds the value 1 and nothing else. The pages are static, so they cannot ask the server who you are without charging every page view. This cookie is how the navigation can say Profile instead of Sign in. It is not HttpOnly, because a script on the page has to read it, and it carries no identity. Signing out deletes it too.

Browsing without an account sets no cookie at all, and the build checks that on every page. There is no consent banner because measurement is cookieless and there is no advertising — nothing that needs a tick box before you read.

Fonts and scripts in our HTML. Fonts are served from this domain rather than from Google Fonts or any other service. The one third-party script written into our pages is the Ahrefs Web Analytics script described above. The pages embed no advertising, no social buttons, no video players and no other trackers — that is checked at build time. Cloudflare Web Analytics is added by our host when the page is delivered, not written into each static file.

What our host records

The site is hosted by Cloudflare, Inc., which automatically logs each request at its network edge: your IP address, the time, the page requested, and your browser's user-agent and referrer. This is ordinary for any website and happens before our code runs.

Why: to keep the site available and to block malicious traffic. Legal basis: legitimate interests, Art 6(1)(f) UK/EU GDPR — the interest being the security and availability of the service, which is difficult to provide otherwise and does not override your rights, since the data is not used to profile or identify you.

Cloudflare acts as our processor — for hosting, edge logs, cookieless Web Analytics, and also for the account record, the sign-in entries and the sign-in emails described below. Its edge logs are retained under Cloudflare's own schedule; the operational logs we enable are kept for a maximum of 7 days and are then deleted. See Cloudflare's privacy policy and its data processing addendum. Cloudflare is a US company and operates a global network, so a request may be served from outside your country; its DPA covers the transfer terms.

If you write to us

Email sent to any address on this site is received and stored by Infomaniak Network SA, in Geneva, Switzerland, who provide our mailbox. They hold the message and the address you sent it from for as long as we keep the correspondence.

Why: to read what you sent and answer it. Legal basis: legitimate interests, Art 6(1)(f) UK/EU GDPR — the interest being the ability to reply to someone who has chosen to contact us, which cannot be done without holding what they wrote.

Infomaniak stores mail only in its own data centres in Switzerland. Switzerland is covered by a European Commission adequacy decision, so your mail reaching it needs no further transfer safeguards. See Infomaniak's confidentiality policy.

How long we keep things

Without an account, nothing accumulates. The pages are static and set no cookie, so the only trace of a visit is our host's logging: Cloudflare's edge logs on its own schedule, and the operational logs we enable, which are deleted after seven days.

Signing in. A link expires fifteen minutes after it is sent. The counter that limits how often one address can be sent a link expires an hour after the last request. A session expires after seven days, and signing out ends it at once.

Your account record — the email address, the membership status and tier, and the payment reference — is kept for as long as the account exists. Ask us to close it and it is deleted. A free account that has not been signed in to for two years is deleted as well, on a review done by hand rather than by a scheduled job. We would rather tell you what happens than describe automation that does not exist.

Email you send us is kept while it is useful, and no longer than twelve months — which is the period the section above defers to when it says Infomaniak holds your message for as long as we keep the correspondence. The exception is correspondence about a request under this policy, which is kept longer: it is the record that we answered you, and being able to show that is itself an obligation.

Invoices are the exception to all of it. Polar keeps them as long as tax law requires. That outlives the account, and it is not ours to delete.

Your rights

If you are in the UK or EU you have the right to ask what personal data we hold about you, to have it corrected or erased, to object to or restrict our processing of it, and to receive it in a portable form.

In practice there is very little to ask for. Without an account, the only data is our host's edge logs, so a request means retrieving or deleting log entries for your IP address. With an account, it is that plus your email address, your membership status and the payment reference. Payment records are held by Polar under their own policy, and invoices are kept as long as tax law requires even after an account is closed.

Write to privacy@cornerlab.ca. We respond within one month. If you are not satisfied you can complain to your local supervisory authority — in the UK the Information Commissioner's Office, and in Canada the Office of the Privacy Commissioner.

Children

This site is not directed at children, and accounts are for people 16 or older. Reading the site needs no account.

How signing in works

There is no password. You can sign in with an emailed link, or with Google when that option is enabled. The link flow: you give an email address, we send a link, and clicking it signs you in. The link works once and expires in fifteen minutes.

Google is optional. If it is offered on the sign-in page, choosing it sends you to Google to approve access. We ask only for your email address and whether Google has verified it — nothing else from your Google account. Google processes that step; we receive the email and the verified flag, then match or create your Corner Lab account the same way as after a magic link.

This is a privacy decision as much as a convenience one. A password would mean storing a hash of it and defending that hash — and a "forgotten password" flow is an emailed link anyway, so the link is the real key either way. Without a password there is simply nothing of that kind to store, lose or leak.

Asking for a link does not create an account; no account record exists until somebody completes sign-in. Until then the address is held only in short-lived entries with our host: the link itself, which works once and expires after fifteen minutes, and a counter and a short cooldown that limit how often one address can be sent a link, the longer of which expires an hour after the last request. An address typed in by mistake, or by somebody else, leaves nothing behind once those expire. Google sign-in uses a similar short-lived entry for the security code of the redirect, not your email, until the round trip finishes or it expires.

The email is sent from signin@cornerlab.ca through Cloudflare's email service. While you are signed in, Cloudflare also holds a session record: the random token from your cookie, linked to your account, for as long as the cookie lasts.

Holding an address for up to an hour to send and limit sign-in links rests on our legitimate interests, Art 6(1)(f) UK/EU GDPR — keeping sign-in secure, and stopping one address being flooded with emails. Google sign-in relies on the same interest for the short-lived redirect state.

Payments

Payments are handled by Polar Software Inc., who act as the seller of record. You buy from them, and they pay us.

Card details never reach Corner Lab. Checkout and the billing portal are Polar's own pages; we never see, store or process a card number, and we hold no billing address. What we receive back is a customer reference and whether the membership is active — which is the whole of it.

When you start checkout we send Polar, with the order, a record that you ticked the consent box on the join page: which wording you agreed to and when. It is kept with the order at Polar, not by us, as the evidence that consent to immediate access was given.

Polar hold the data needed to sell to you and to meet their tax obligations, under their own privacy policy. They are a US company; where that means a transfer out of the UK or EEA, their terms carry the transfer safeguards.

The legal basis for holding your email address, membership status and payment reference is contract — we cannot give you what you paid for without knowing who you are and whether you paid. Invoice records are kept as long as tax law requires, which is a legal obligation and outlives the account.

When this changes

Any change is published here with a new date at the top. A material one is announced rather than quietly edited.