Legal
Cookies
Two cookies, both strictly necessary, neither used to track you. That is why there is no banner asking about them.
The cookies
- Session
- Set when you sign in. Holds 32 random bytes; the server stores only their hash. httpOnly, SameSite=Lax, and secure in production. Removed when you sign out.
- OAuth state
- Set for a few minutes while you are away at Google or Facebook, so the reply can be checked against the request that started it. Deleted as soon as you land back.
Not cookies, but worth naming
Your cart, recently viewed products and compare selection are kept in this browser’s local storage. They are never transmitted. The privacy page lists everything else the site records.
No third-party cookies
There is no advertising, no analytics vendor and no embedded widget on this site, so nothing else sets a cookie in your browser from here.