Cookies

A cookie is a small file a site stores on your device so it can recognise you between one page and the next. Browsers also offer local storage, which does much the same job by a different mechanism. The law treats the two together — the rules on cookies cover “cookies and similar technologies” — and so does this page, because the distinction is a technical one and you should not have to care about it to find out what is on your device.

There are two groups, and the difference between them is the one worth understanding: most of it never leaves your device, and one small thing is sent to us with every request. All of it is there so the shop works. None of it is analytics, advertising or profiling.

Kept on your device, never sent to us

These sit in your browser's own storage. They are not transmitted anywhere as you browse — we cannot read them from our server, and another website cannot read them at all.

• Your basket. What you have added and how many, so it is still there when you come back or refresh the page. Without this a basket empties itself every time you navigate.
• Your signed-in session. So you stay signed in between pages, and so two open tabs agree about who you are.
• Your saved addresses and order history. So the account pages can show what you have ordered and let you reuse a delivery address.
• Your wishlist. The products you have saved, so they survive a refresh.

Sent to our server with every request

One cookie, and we would rather point at it than leave you to find it: provenience_cart_id.

• What it holds. An identifier for your basket — a meaningless string that points at the basket on our side. Not its contents, not your name, nothing about you.
• Why it is a cookie rather than device storage. Because it has to reach us. When a page is put together on our server rather than in your browser, this is the only way it can tell whose basket to show — the storage above is invisible to a server by design. That is the entire reason it exists.
• How long it lasts. Thirty days, then it expires by itself. It is scoped to this site, set so another website cannot cause it to be sent, and only sent over an encrypted connection.

Unlike everything in the previous section, this one travels to us on every request you make to this site, which is why it gets its own heading rather than a footnote. It is not used to build a profile of you, to measure what you look at, or to recognise you anywhere else, and it goes nowhere near an advertiser.

Also unavoidable

The security token that stops somebody submitting a form on your behalf, and the ordinary operational cookies our host uses to route traffic and absorb an attack.

All of it is strictly necessary

Every item above is part of what you asked for by using a shop, so none of it requires your consent — and there is no way to switch it off and still have a working basket. Clearing this site's cookies and storage in your browser removes all of it; the consequence is an empty basket and being signed out, nothing more.

What we do not do

• No analytics. We do not currently measure which pages you visit.
• No advertising or retargeting cookies, and no data shared with ad networks.
• No third-party tracking scripts. Nothing on this site loads a tag from somebody else.
• Nothing that identifies you across other people's websites.
• We do not sell any of it.

Consent

Everything this site currently stores is strictly necessary, which is the one category that does not require asking. We still ask, because the alternative is adding tags first and apologising afterwards.

The cookie panel appears on your first visit and offers Reject all just as prominently as Accept all. Nothing beyond the basket is switched on unless you turn it on, refusing is remembered so you are not asked again, and you can change your mind at any time from Cookie settings at the bottom of any page. Analytics, preference and advertising categories are listed there and are all off — when any of them is actually used, it will only run if you have said yes first.

Managing it yourself

Every major browser lets you see, clear and block cookies and site storage, and block a site by default — look under privacy or site settings. Blocking ours will stop the basket, sign-in and wishlist working, because those are the things it is holding.

Third parties

When payments launch, the payment provider will set its own cookies during checkout, because processing a card safely requires it. Those will be listed here before that happens.

How we handle the personal data behind all of this is set out in the privacy policy, which this page forms part of.