Cookie policy

We count visits to our website so we can tell which pages work. Before you answer our cookie question, or if you say no, that counting keeps nothing on your device that could recognise it again: each page load is counted on its own.

If you say yes, we also keep a visitor ID in your browser and use PostHog, in its EU cloud, for heatmaps and screen recordings of our public pages. Everything you type is hidden from recordings. We use no advertising cookies and we do not use Google Analytics.

These make the site work. They need no consent, and none of them is used to follow you around.

• __Host-membber_session, Supabase sb-* keys

  Keep you signed in once you sign in. Not set if you only browse.

• membber.resetEmail

  The email you last asked for a password reset link for, kept for one hour so a link that no longer works can send a new one. Removed when you set your new password.

• cookie-consent

  Remembers your answer to our cookie question, so we do not ask on every page.

• NEXT_LOCALE

  Remembers your language, only if you choose one.

• membber-basket, membber.buyer.<shop>, tlc_signup_intent_v1

  Your basket while you shop (this tab only); after you order from a shop, your name and contact details for that shop so you are not asked twice (each shop's page offers to forget them); and, while you sign up with Apple or Google, what you were signing up for so the page can finish when you come back.

• __stripe_mid, __stripe_sid

  Set by Stripe on payment pages only, to prevent card fraud.

• tlc_page_loaded, tlc_previous_pathname, tlc_navigation_type, tlc_loader_*, membber_loader_seen

  Whether the loading animation has already played in this tab, so it does not replay on every page. Cleared when the tab closes.

• pwa-prompt-dismissed, pwa-installed

  Whether you closed or accepted the prompt to add our app to your home screen, so we do not ask again.

• Our own visit counter

  Which page was viewed, how far down it was scrolled, which buttons and links were tapped (their label, never anything you type), how long the page was open, the kind of device and browser, and where the visit came from, such as the campaign tags on a link or the site that linked to us. Before you answer, or after you say no, nothing is stored on your device for it. Web addresses are kept without any private part, such as an order code or a sign-in token, and our order, payment and sign-in link pages are never recorded. We do not store your IP address with these records. Detailed records are kept for 30 days, then only daily totals.

• Vercel Speed Insights

  Measures how quickly our pages load. It sets nothing on your device and records the page address with any private part removed.

• Vercel Web Analytics

  Counts page visits and the site or campaign tags they came from. It sets nothing on your device, stores no identifier, and records the page address with any private part removed.

• Sentry

  Receives an error report when something on the page breaks, so we can fix it.

• tlc-web-device-id, tlc-web-first-touch, tlc-web-session-id, tlc-web-session-touch

  Our visitor ID, so a return visit can be told apart from a new one, and where your first visit came from. The last two last only while the tab is open.

• tlc-ab-v2:*, tlc-ab-active-variant

  Which version of a page you were shown, when we compare two versions of one page.

• PostHog (EU cloud): ph_<key>_posthog, ph_<key>_window_id, __ph_opt_in_out_<key>

  Heatmaps (where people tap and scroll) and screen recordings of our public pages: the home page, the Drops pages, pricing, the blog and similar pages, and the signup page. Everything you type is hidden from recordings. PostHog never runs on order, payment, sign-in or seller pages, or anywhere you are signed in to run a shop. It keeps its data in the EU and is set to discard your IP address. It stores its ID in your browser, not in a cookie.

We rely on your consent for these. Saying no, now or later, deletes all of them from your browser.

Use the button below, or “Cookie settings” at the foot of our pages. Your new answer applies at once, and saying no removes the visitor ID and everything PostHog stored in your browser.

You can also clear or block site data in your browser settings. Signing in, your basket and checkout need the strictly necessary items above. For how we handle personal data generally, see our privacy policy.