Who we are
Rice Cracker Club is run by Rice Cracker LLC in Oakland, California. This policy covers our website. We show no advertising, and we sell nothing to data brokers. We do use one third-party analytics tool, Microsoft Clarity, and it is the exception to most of what follows — it has a section of its own below, including how to switch it off.
What we collect
- Contact details you give us — your email address (sign-in, orders, the newsletter); your name and optional phone number if you send a catering inquiry, along with what you write there; the display name you put on a product review.
- Order and subscription records — what you bought, amounts and order status, subscription state, and the name and US shipping address you enter at Stripe's checkout. Payment card details are collected by Stripe on its hosted checkout page and never touch our servers.
- Technical data for security — IP addresses on sign-in, checkout and form submissions (rate-limiting and abuse prevention); the browser user-agent on signed-in sessions; one-time sign-in codes stored only as salted hashes; if you add a passkey, its public key and usage metadata (the private key never leaves your device, and you can remove passkeys on your account page). Our own cookies are two, both essential and first-party:
rcc_session(keeps you signed in, 30 days) andrcc_cart(your cart — item IDs and quantities only, 30 days). Microsoft Clarity sets its own, listed below.
Analytics: Microsoft Clarity
We use Microsoft Clarity to see how people actually use the site. It records how pages render and how you interact with them — mouse movement, clicks, scrolls — and plays those back to us as session recordings and heatmaps. Clarity masks page text by default, so what we see is layout and movement rather than the words on the page. Microsoft keeps the recordings for 30 days.
Microsoft is not a service provider working only on our instructions. For Clarity it acts as an independent data controller and uses what it collects for its own purposes, including advertising. It sets its own cookies — two first-party ones (_clck, _clsk) that give your browser a pseudonymous ID, plus cookies on Microsoft domains (CLID, MUID, ANONCHK, MR, SM) — of which MUID is an advertising cookie that identifies your browser across Microsoft sites. Microsoft explains its own use in the Microsoft Privacy Statement.
Because Microsoft uses it for itself, California law treats this as selling or sharing personal information, so you can switch it off. Microsoft states that Clarity honors the Global Privacy Control signal, so turning GPC on in your browser or privacy extension stops it. You can also opt out of Microsoft's collection specifically at the Digital Advertising Alliance opt-out page. Clarity is the only thing on this site that this applies to, and opting out changes nothing about your account, your orders or the price of anything.
Who it is shared with
Only service providers acting on our instructions, each receiving just what its job needs: our payment processor (Stripe); transactional email providers (Resend and Cloudflare Email Sending); Cloudflare for bot protection and inbound email routing — its Turnstile widget on our forms processes technical browser signals and your IP address to tell people from bots; and a place-search service for the catering form (Photon / OpenStreetMap), which receives only the venue text you type, never your IP address or cookies. Microsoft is the one exception to "acting on our instructions" — see the Clarity section above. Beyond that, we disclose information only if the law requires it, or as part of a sale or merger of the business under this policy's promises.
Access, correction and deletion
You can permanently delete your account yourself from your account page — it cancels any active subscription immediately and erases your account data, except order records kept for tax and accounting. For anything else — a copy of what we hold, a correction, deletion without an account, or unsubscribing from the newsletter — email [email protected] from the address involved and we will act on it, whoever and wherever you are. California residents' statutory rights, and the exact inventory of what deletion removes and retains, are in Your California Privacy Rights.
Do Not Track
We do not track you across other websites ourselves. Microsoft does: through the Clarity cookies described above, it can recognize your browser on other sites that use Clarity or Microsoft advertising. Neither this site nor Clarity changes its behavior in response to a browser "Do Not Track" header — the signal never got an agreed meaning, and Microsoft states that Clarity does not respond to it. Global Privacy Control is the signal that does work, and the Clarity section above explains how to use it.
Changes and contact
If this policy changes materially, we will post the new version on this page and move the effective date above before the change applies. Questions and requests: [email protected] — Rice Cracker LLC, Oakland, California.