Cookie policy

A cookie is a small text file that a website asks your browser to keep. It holds a short piece of information — a basket number, a language, a random identifier — and hands it back the next time you load a page. That is how a shop remembers there are two pens in your basket while you go and read the shipping page.

This policy also covers the things that behave like cookies without technically being one: local storage, session storage, pixels, tags and software development kits. We call the lot cookies here, because that is what everyone calls them.

Cookies come in two flavours. First-party cookies are set by this shop. Third-party cookies are set by another company whose code runs on a page — an analytics tool, an advertising platform. Third-party cookies are the ones people worry about, and they are the ones that wait for your consent here.

A cookie cannot run a program, carry a virus or read the other files on your device. What it can do is recognise the same browser across visits, which is useful for a basket and rather more sensitive for an advert.

These are the ones the shop cannot work without. They keep your basket together as you move between pages, carry you through checkout, keep you signed in if you have an account, and protect the site against fraud and abuse. They also spread traffic across servers so the shop stays up on a busy day.

No consent is needed for these, and there is no way to switch them off from our side. That is not a loophole: the law exempts cookies that are strictly necessary to deliver a service you have asked for. If you block them in your browser, the basket empties, checkout breaks, and there is nothing we can do about it.

Nothing in this category is used to profile you or to sell you anything anywhere else.

Preference cookies remember small decisions so you do not have to make them twice: the language you read in, the currency prices are shown in, the country you are shipping to, whether you have already dismissed a banner.

They make the shop more comfortable rather than more functional, so they wait for your consent. Refuse them and everything still works — you may simply have to pick your currency again on the next visit.

They hold a setting, not an identity. There is no name and no email in them.

Analytics cookies count. They tell us how many people looked at the pen this week, which pages they read before buying, where a page loads too slowly and at which step of checkout people give up. That is how a small shop finds out that a photograph is confusing or a link is broken.

The reports we see are aggregated: numbers and trends, not a list of people. We do not use analytics to build a profile of you or to advertise to you elsewhere.

These cookies are set only if you accept them. Refuse, and we lose a line in a chart. Nothing about your visit or your order changes.

Marketing cookies are set by advertising platforms so they can tell whether an advert did anything. They record that a browser which saw an advert later reached the shop, looked at a product or completed an order, and they can be used to show you a related advert on another site.

These are the most intrusive cookies on any shop, and they are off until you switch them on. They never fire before you have said yes on the privacy banner, and refusing them has no effect at all on your ability to browse, order, pay or get a refund.

If you accept them, the platform concerned — not us — is the one holding that data, under its own policy. Withdraw consent and we stop sending it new events, though anything already collected is governed by that platform's own retention rules and its own settings.

The shop runs on Shopify, which sets its own first-party cookies so the basket and the checkout work. They are strictly necessary, so they are on from your first page view. The usual ones are:

• cart, cart_ts, cart_ver — what is in your basket and when it last changed;
• _secure_session_id — keeps your session together while you move through checkout;
• secure_customer_sig, checkout_token — keep you signed in and tie you to the order you are paying for;
• _tracking_consent — records the choice you made on the privacy banner, so we do not ask again on every page;
• _shopify_y, _shopify_s — Shopify's own visitor and session identifiers, used for the shop's built-in reports.

Shopify updates its platform, so the exact names can change without us touching a line of the theme. The list above is indicative; your browser's developer tools will always show you the real, current one for this site.

Beyond what Shopify needs, a shop this size uses very little. Where we use one of the tools below, its script is blocked until you accept the matching category on the privacy banner.

• Google Analytics (analytics) — counts visits and pages. Sets cookies such as _ga and _ga_<id>. Fires only after you accept analytics.
• Meta pixel (marketing) — measures whether an advert on Facebook or Instagram led to an order. Sets cookies such as _fbp, and _fbc if you arrived through an advert. Fires only after you accept marketing.
• Shopify's own reports (necessary and analytics) — built into the platform and covered by the clause above.

Embedded content can bring its own cookies with it. A video or a map dropped into a page is served by the platform that hosts it, and that platform sets cookies under its own policy the moment the content loads.

Payment providers at checkout set cookies of their own for fraud prevention. Those are necessary: without them, the payment cannot be checked.

A session cookie disappears when you close the browser. A persistent cookie has an expiry date written into it and stays until that date, or until you clear it.

As a rough guide, and these are indicative rather than a promise:

• session and checkout cookies — from thirty minutes to twenty-four hours;
• basket cookies — around two weeks;
• your consent choice — up to twelve months, after which the banner asks again;
• preference cookies — up to twelve months;
• analytics cookies — commonly thirteen months to two years, depending on the tool's settings;
• marketing cookies — commonly three months, set and renewed by the platform.

Under European rules, consent gathered for analytics and marketing is not open-ended: it is customary to ask again after about thirteen months, and that is what the banner does. Clearing your cookies resets everything, including your recorded choice, so the banner will greet you again on the next visit.

The first time you arrive, a privacy banner asks what you are happy with. You can accept everything, refuse everything, or pick category by category. Refusing is exactly as easy as accepting, and nothing is set beyond the strictly necessary cookies until you have chosen.

You can change your mind whenever you like. Open the cookie or privacy settings link in the footer, or clear this site's cookies in your browser, and the banner comes back. A new choice replaces the old one straight away, and scripts you have withdrawn consent from stop firing on the next page load.

Refusing changes nothing about what you can buy. The basket, the checkout, the delivery options, the price, the returns window and the two-year warranty are identical whether you accept every cookie or none. We do not hide products, delay orders or charge more because you said no, and there is no wall in front of the shop for anyone who refuses.

If you have accepted and later want the data deleted rather than just stopped, ask us — the routes for that are in the privacy policy.

Your browser has the last word, whatever any banner says. Every one of them lets you see the cookies a site has set, delete them, block third-party cookies, or block the lot. Look under Settings, then Privacy — the exact path changes with each version, which is why we are not printing a menu tree that will be wrong by winter.

Private or incognito windows clear everything when you close them, which is a decent way to browse without leaving a trace. Some browsers block third-party cookies outright by default, so certain tools never load at all.

Blocking every cookie, everywhere, has consequences well beyond this shop: baskets forget themselves, sign-ins do not stick, and some checkouts refuse to complete. Blocking third-party cookies only is the setting most people actually want.

Google publishes a browser add-on that opts you out of Google Analytics across every site: tools.google.com/dlpage/gaoptout. Advertising platforms have their own settings inside your account with them, and those work whatever you tell us here.

Some cookies hold nothing but a setting. Others hold a random identifier that, combined with other data, counts as personal data under the GDPR and the equivalent rules elsewhere. Where that is the case, our lawful basis is your consent — except for the strictly necessary cookies, which rest on our legitimate interest in delivering a shop that works.

You have the right to ask what we hold, to have it corrected or deleted, to object to how it is used, to ask for a copy, and to withdraw consent at any time without giving a reason. Withdrawing consent does not undo what was lawfully collected before, but it stops the collection from that point.

Where a third-party tool sends data outside your own country, that transfer is covered by the safeguards described in the privacy policy, which is the document to read for the full picture — including who we share data with, how long we keep it and how to make a complaint to a supervisory authority.

To exercise any of this, write to [Email] or use the contact page.

Cookies change more often than most legal pages. A tool is added, another is dropped, Shopify renames something. When that happens we update this page, and the date at the top tells you which version you are reading.

If a change means we want to set a new category of cookie, we will not do it quietly: the banner will ask you again before anything new is written to your device.

Bookmark this page if you like keeping an eye on such things. It is the fastest way to see what a small shop is actually running.