Cookie Policy

1. What Are Cookies?

Cookies are small text files placed on your device. Similar technologies include local storage and server-side session identifiers. They keep essential features running (sessions, cart, security).

This storefront relies only on strictly necessary cookies. We do not use analytics, advertising, or social media tracking cookies at this time.

2. Strictly Necessary Cookies We Use

These cookies are required to deliver the services you request (including checkout and payments) and are exempt from consent under the applicable ePrivacy rules. Blocking them will break key functionality.

- `session` (first-party, httpOnly, path=/, SameSite=Lax) — set by our Remix-based session storage (see app/lib/session.ts). It keeps you signed in, stores short-lived system messages, and persists account/security state. Lifespan: session by default; renewed when you interact with the site.

- `cartId` (first-party, set via the Shopify Hydrogen cart API) — created when you add items to your basket so we can load the same cart on each page. Lifespan: up to ~7 days or until the cart is cleared.

- Shopify / Shop Pay / checkout cookies (first-party) — essential cookies issued by Shopify and Shopify Payments that support the cart, checkout flow, payment routing and Strong Customer Authentication (3-D Secure) for payment methods such as Visa, Mastercard, American Express, Maestro, UnionPay, Bancontact (Belgium) and EPS (Austria). Lifespans range from a single session to a few days.

- Wallet cookies and similar technologies for Apple Pay and Google Pay (third-party, only if you choose these methods) — used by Apple and Google to authenticate you, process the transaction securely, apply Strong Customer Authentication where required and prevent misuse. These may be set on Apple- or Google-operated domains and typically last from the duration of the payment session up to a few days.

- Klarna session and risk/fraud-prevention cookies (third-party, only if you choose Klarna pay-now or pay-later options) — required for Klarna to provide its payment service, including basic risk checks and, where applicable, creditworthiness assessments. These are set on Klarna-operated domains and generally persist for the payment session and a limited period thereafter.

- PayPal session and fraud-prevention cookies (third-party, only if you select PayPal) — required to complete the PayPal payment flow securely, including risk and fraud checks. These may be set on PayPal-operated domains. Lifespans vary from a single session to a few days.

Some local or redirect-based payment methods (such as Bancontact or EPS) may use additional strictly necessary cookies or similar technologies on their own domains during the payment process. These are controlled by the respective providers and are required to complete the transaction securely.

We do not currently set additional first-party cookies for consent, analytics or personalization. If this changes, we will update this notice and, where required, obtain your consent first.

3. Performance & Analytics Cookies

None. We do not deploy Google Analytics, Meta Pixel, or any other analytics/performance tool.

4. Marketing Cookies

None. We do not place advertising, retargeting, or social media tracking cookies.

5. Managing Cookies

Browser controls: You can block or delete cookies via your browser settings. Disabling strictly necessary cookies will prevent login, cart, checkout and payment from working correctly.

Future updates: If we introduce optional cookies (analytics, marketing, preference), we will show a consent banner and provide in-site controls to change your choices at any time.

International transfers: Hosting and cart services run on Shopify Oxygen, which may process data outside the EEA. Payment-related cookies and similar technologies from Shopify Payments, PayPal, Klarna, Apple Pay, Google Pay and local payment providers may also involve processing outside the EEA. These providers typically rely on Standard Contractual Clauses or other safeguards for such transfers. Back-in-stock or email sign-ups handled via Klaviyo follow the same safeguards when enabled.