Cookie Policy

Administrators use necessary Supabase authentication cookies, including session cookies with names beginning sb- and temporary PKCE verification cookies for account recovery and email confirmation. Session cookies are HttpOnly, use SameSite=Lax and are Secure on the public HTTPS website. They are refreshed with the session and cleared on sign-out. Ordinary browsing does not require an administrator account. Clearing your saved shopping bag does not sign an administrator out.

When test payment is enabled, reviewing checkout sets the necessary first-party seen_checkout_owner cookie for up to 30 days. It is a random browser ownership token, contains no contact or card details, uses HttpOnly and SameSite=Lax, and is Secure on HTTPS. It authorises private test-order access after returning from Stripe. Blocking or clearing it prevents access to those orders in that browser. Stripe-hosted Checkout uses its own payment and fraud-prevention technologies; no Stripe script is loaded by this storefront. Clearing your bag does not cancel a pending checkout or remove this cookie.

Cookies and browser storage can remember information on your device. This page covers local storage as well as cookies; using local storage does not make a technology exempt from privacy rules.

The storefront uses first-party local storage to remember product variant references and quantities in your bag. It does not save payment card details, your name, email or delivery address in those entries.

Storage names

seen.bag.v1 and, for sample products, seen.bag.v1.development

Purpose

Remembering the shopping bag you request

Duration

Until removed by you or your browser; there is currently no automatic expiry

Standard and development bags use separate entries. You can clear both with the control below. Clearing one item from your bag removes that selection from the active saved bag.

Contact sending is not yet configured. The Turnstile widget does not load while the form is unavailable. When enabled, Turnstile processes browser and device signals for security. Its storage behaviour depends on the service and widget configuration; it is not an advertising feature.

Read the Cloudflare Turnstile Privacy Addendum. Any hosting-level security cookies must also be recorded when the hosting environment is confirmed.

The current storefront does not install analytics, advertising pixels or marketing tracking tools. Fonts and product images are served by the site.

If optional tracking is added, this page and its controls must be updated before it runs. Where consent is required, you must be able to decline optional tracking without losing access to the store.

You can also inspect or remove this site's cookies and local storage in your browser's site-data settings. Blocking necessary storage can prevent your bag from being remembered between visits. This button does not clear third-party cookies or unrelated browser data.

Read our Privacy Policy for personal information and contact choices. Hosting and security storage will be reviewed before launch so this policy reflects the final setup.