Cookie Policy

Sign-in cookies, set only when you sign in (their names may begin “__Secure-”): better-auth.session_token keeps you signed in (30 days); better-auth.session_data is a short-lived copy of it (5 minutes); better-auth.dont_remember may be set if you sign in for this visit only.

sa.cart.v1 (local storage) remembers what is in your cart between visits. It never leaves your browser except as a list of product identifiers sent to our server to be priced.

sa.currency.v1 (local storage) remembers which currency to show your prices in, pounds, euros or US dollars, and when we last checked. It holds nothing else and never leaves your browser.

sa.consent.v1 (local storage) remembers your privacy choice - Analytics and Advertising, each on or off, the wording you saw and when - so we can honour it, including a refusal. It holds nothing that identifies you. We ask again if our wording changes, about six months after a refusal, or about thirteen months after you allowed Analytics or Advertising.

When you use a sign-up form, Cloudflare Turnstile checks that you are a person; see the privacy notice.

sa.v1 (local storage): a random ID, and the time you were last active here, so that visits from the same browser can be recognised as yours. It is created only when you allow Analytics. When you switch Analytics off it is deleted as soon as our server confirms it has deleted what was recorded against it; until then it holds only the ID, marked for deletion. If your permission lapses (after about 13 months, or when we change this wording) it stays, unused, so that switching off can still delete everything; if you allow Analytics again, the same ID continues. What we record against it, why, and for how long is set out in the privacy notice.

It is our own analytics. No third-party analytics script runs on this site, and our website does not send your analytics information to any advertiser.

Off unless you allow it. If you switch Advertising on, your browser loads Meta's pixel from Meta's servers, and Meta sets and reads two cookies on our domain: _fbp, a random ID for this browser, and _fbc, the advert you arrived from, if you arrived from one (90 days each). If you are logged in to Facebook or Instagram in the same browser, Meta may also read its own cookies on its own domains. What the pixel tells Meta, and from which pages, is set out in the privacy notice.

Google's ads tag loads only when you arrive from one of our Google adverts, and on the thank-you page after a payment Stripe has confirmed. Google then sets and reads two cookies on our domain: _gcl_au, a random ID for this browser, and _gcl_aw, the Google advert you arrived from, if you arrived from one (90 days each). If you are logged in to Google in the same browser, Google may also read its own cookies on its own domains. sa.ads.purchases (local storage) keeps the order numbers already reported to Google from this browser, so that a purchase is never reported twice; it never leaves your browser. sa.checkout.return (session storage) holds the thank-you page's own address in that tab while Google's tag runs, so that reloading the page still shows your order; it never leaves your browser and is gone when you close the tab.

Without that choice, nothing loads from Meta or Google and no advertising cookie is set. An in-app browser, such as Instagram's, is the app maker's own software and follows its own policies. A product video you choose to play comes from YouTube: see below.

A plug-in's page can show its walkthrough video. Nothing is loaded from YouTube until you press play. When you do, the video plays from YouTube's privacy-enhanced address (youtube-nocookie.com), and YouTube, which belongs to Google, may store its own cookies or similar data in your browser under its own policies. We set none of it, and we receive nothing from it. If you never press play, YouTube is not contacted.

Choose Privacy choices at the foot of any page. Switching Analytics off deletes this browser's ID and everything we recorded against it. It works from the browser that holds the ID; the privacy notice explains what to do if that browser's storage has been cleared.

Switching Advertising off stops Meta's pixel and Google's tag, and deletes _fbp, _fbc, Google's _gcl_ cookies and sa.ads.purchases from our domain. Meta and Google keep what they had already received; the privacy notice explains how to ask them about it.