Cookies

What is set

• Your bag30 days

  Holds a random token that points at a cart stored on our server. The items and prices are never kept in your browser, so nothing about what you are buying can be edited on the way to checkout.

• Signed-in sessionUntil you sign out or it expires

  Set only if you sign in. It holds a random token; what we store is a SHA-256 hash of it, so the database never contains anything that could be replayed as a login.

• Anti-abuseShort-lived

  Set by the challenge on the newsletter form to tell a person from a script. It carries no identity and is not used to track you between visits.

TO CONFIRM: the exact cookie names and the session lifetime, once the cart and auth routes ship

All three are httpOnly

Which means JavaScript on the page cannot read them, including any script that ever managed to get onto the page. It also means the tokens are useless on their own: each one is a random string that identifies a record on our server and carries no information about you.

What is not set

No advertising cookies. No cross-site tracking pixels. No third-party analytics following you around the internet, and no data sold or handed to an ad network. Your bag and your session are not stored in localStorage either — they live on our server, which is a security decision before it is a privacy one.

TO CONFIRM: whether any analytics is deployed in production — if one is added, it must be listed here before it goes live

Blocking them

Every browser lets you refuse or delete cookies for a site. Blocking these ones does not break browsing — you can look at everything without them — but the bag will empty between pages and signing in will not hold. There is nothing we can do about that: with no token there is no way to tell your bag from someone else's.

Questions

What we do with the rest of your information is on theprivacy page, and anything this page does not answer goes to thecontact page.