Cookies & privacy choices

Last updated: October 14, 2026

Some browser storage keeps your bag, secure checkout and order access working. Product-interest counts and Google Ads measurement have separate controls. Store counts require acceptance; Google Ads browser measurement uses the regional default described below. You can turn either off and continue shopping. Open Cookie & privacy choices to review or change your settings.

Storage used by this store

Our checkout, secure order-access and charity cookies are Secure, HttpOnly and SameSite=Lax. Browser session restoration can retain session storage. Expired acceptances no longer enable store counts or server purchase reporting. The browser advertising tag follows the regional settings below when no saved opt-out remains; an old record may remain locally until replaced or cleared. Administrator sign-in uses platform-managed security storage. Whop's payment service has its own cookies and data practices, described below.

Cloudflare provides hosting security and may set the __cf_bm cookie to distinguish automated traffic from visitors. It expires after 30 minutes of inactivity. This security cookie is separate from optional store measurement. See Cloudflare’s cookie information.

Optional store analytics

Store analytics starts off and requires your acceptance of this updated purpose. We keep aggregate product-interest counts and use a random, short-lived session reference to measure product-detail views, bag actions and checkout steps. We can link that session to your server-confirmed order to understand where shopping visits lead to purchases. The session reference stays in this tab; our server keeps only its hash. It expires after 30 minutes of inactivity or 24 hours. We record product IDs, quantities, device-size category, a safe landing-page path, referring website hostname when available and limited campaign labels (UTM source, medium and campaign). We do not record your name, email, address, payment details, IP address, raw URL/query string or raw browser user-agent in these analytics. We do not use fingerprinting.

Raw session, event and order-link records become eligible for deletion after 30 days and are removed in bounded batches as new analytics events arrive. Aggregate daily product counts can remain for store reporting. Withdrawing analytics permission clears this tab’s session reference and requests deletion of its session events and order link. A necessary session-storage marker retries this privacy request when the connection returns. This does not delete order records needed to provide and account for your purchase. If browser storage is unavailable or cleared before a failed request succeeds, contact us for help. Global Privacy Control and Do Not Track keep optional analytics off. Earlier grants for aggregate-only counts are not reused for this expanded purpose; earlier rejections stay in effect. We process analytics on our hosting infrastructure and do not send it to Google or another analytics service. Google Analytics is not enabled.

Advertising cookies

Google Ads browser measurement is on by default when our server identifies your visit as being in the United States, unless you have a saved advertising opt-out or your browser sends Global Privacy Control or Do Not Track. Outside the United States, or when we cannot determine your location, the tag stays off until you accept the advertising choice. You can turn it off from the privacy notice or Cookie & privacy choices, also linked in our footer. Shopping and checkout work either way.

This US default is not saved as your consent. Optional store analytics and our separate purchase reporting from the server still require your affirmative acceptance. The browser tag helps us understand which ads lead to purchases. Google receives ad-click identifiers, browser and network information (including IP address), page information, and, for a confirmed retail purchase, its merchandise value after discounts, currency, a random order reference, purchased product IDs, quantities, unit prices and the order discount. Purchase value excludes sales tax and delivery charges. We do not send your name, email, address or payment details through this feature. Enhanced conversions, personalized advertising and Google Analytics are not enabled. This measurement uses advertising cookies; it is separate from our store analytics. See Google's privacy policy and how Google uses information from sites.

Google's `_gcl_` advertising cookies normally last 90 days, subject to browser restrictions. We save your separate advertising choice in `den-nook-advertising` for up to 180 days and keep attempted-conversion references in browser session storage to reduce duplicate events. Google applies its own data-retention rules; cookie lifetime does not describe how long Google retains all measurement data. See Google's cookie information and retention information. Turning advertising measurement off removes this site's first-party Google advertising cookies and refreshes the page when needed to stop its loaded tag. It cannot undo information already sent. Global Privacy Control and Do Not Track prevent this measurement, even after an earlier acceptance.

Use the privacy notice to accept or reject optional measurement, or manage store counts and Google Ads separately in Cookie & privacy choices. You can turn Google Ads browser measurement off there at any time, including when it was enabled by the US default. We save choices you make, their version and time in this browser for up to 180 days. If those choices are cleared or expire, store counts and server purchase reporting require acceptance again; the regional default may apply to the browser tag when no saved opt-out remains. Default-on settings are not consent. Global Privacy Control and Do Not Track override both the US default and an accepted choice. Your basket, checkout and order updates work either way.

Payment-service storage

when you open secure checkout, Whop provides the payment form and uses its own cookies and data practices. See Whop's privacy policy. Our store-measurement choice does not switch off Whop's payment-service storage.

Browser controls and privacy requests

you can control or delete cookies and browser storage in your browser settings. Blocking necessary storage may interrupt the basket or checkout. Our Privacy Policy explains other information we collect, retention, your rights and contact details.

Optional charity preferences

If you choose to save a charity preference, we store the selected charity, a random browser identifier and the time of your selection. A preference cookie remembers that choice for up to one year and lets you update it. We set it only when you save your preference; accepting store measurement does not cast a vote. This preference is not linked to your email, payment or order. It helps inform our first planned donation; it is not a binding election. No purchase is required. We keep preference records while planning our first donation. Cookie expiry or clearing removes this browser’s access to its saved preference; it does not automatically delete the stored record.

Secure order access

When you request access from another device, we use your order reference and checkout email to send a private, single-use link. The link expires after 15 minutes. Opening it and confirming access sets an essential, order-specific cookie for up to seven days. We also keep hashed security identifiers and access timestamps to limit repeated requests and protect order information. This service does not subscribe you to marketing.

Optional purchase reporting after checkout

Only after you affirmatively accept the current Google Ads measurement choice, we save an ad-click identifier (`gclid`, `wbraid` or `gbraid`) and that permission with your order. The US browser default alone does not enable this server purchase reporting. This lets our server report a verified purchase to the same Google Ads conversion action even if you close the checkout page. We send the original payment time, merchandise value after discounts, currency, ad-click identifier and random order reference. This feature does not send your name, email, address or payment details and does not enable personalized advertising. We use the same order reference to avoid counting the same purchase twice.

The optional browser record `den-nook-order-attribution` retains the click identifier and choice for up to 90 days from capture. Raw identifiers on our server are deleted after that period, or after seven days for an unpaid checkout. Non-identifying delivery references and outcomes may remain for reconciliation. An earlier acceptance does not enable this expanded purpose until you make the updated choice.

Withdrawing advertising consent clears the browser record and requests deletion of saved click identifiers and suppression of pending reports for orders linked to this browser’s checkout cookie. The necessary `den-nook-ads-withdrawal-pending:*` markers retry privacy requests if the network is unavailable; each is removed when its request succeeds. Withdrawal cannot recall an in-flight report or undo data already sent to Google. If your checkout cookie has expired, or you used a different device, contact team@denandnook.com for help with a privacy request. Global Privacy Control and Do Not Track also stop this optional capture and request withdrawal for this browser.

Remembering checkout choices

The essential browser-session record `dn-checkout-extras-v1` remembers whether you selected optional delivery protection and which tip amount you chose. Your saved checkout attempt also retains its original items, offer and optional choices so an interrupted payment can be checked without changing its total. These records support your checkout and do not enable marketing or advertising. Clearing browser storage may remove the local choices; it does not cancel a payment already started.