Legal
Cookies and local storage
Last updated October 1, 2026
This site sets one cookie of its own, keeps two items in your browser's local storage, loads one advertising script, and — while you are signed in — sets the session cookies that keep you signed in. Most of that is strictly necessary for the site to work; two things are not — the unfinished-order record and the advertising script — see "What we set, and why" below for both.
What we set, and why
A cookie on this site does one of two things: it remembers that you completed the researcher gate, so you are not asked again on every page, or, while you are signed in, it keeps your session. Local storage holds your order between page loads, and separately holds a random id for the item below.
If you add something to your order and do not complete it, that id lets us record what was in it — which products, and the quantities — against that id, once it has been quiet for a while. If you type an email address into the checkout page before finishing, it is attached to the same record, so we can reach out about the order you did not complete. We use this to follow up on unfinished orders; we do not sell it, share it with anyone outside this business, or use it to build an advertising profile of you. The record is deleted outright the moment you either complete a real order or empty your own order yourself — it is not kept "just in case" once either happens.
Separately, this site loads a tracking script from Taboola, the advertising network we run ads through. It records that a page here was viewed, which Taboola uses to measure whether its ads led to a visit and to show you ads for this site elsewhere on the web. This one is genuinely third-party and genuinely advertising — unlike everything else on this page, Taboola's own privacy policy governs what it does with what it collects, not this one.
The researcher-gate cookie contains no identifier we can trace back to you, and neither does your saved order in local storage. The id used for the unfinished-order record above is a random value with no name or email baked into it — it identifies a browser, not a person, until an email is separately typed in. A session cookie does identify your account — that is what a session is — and it lasts from sign-in until you sign out or it expires.
The full list
This is the complete inventory. If you find something in your browser from this site that is not on this list, we want to hear about it.
- al_researcher_verified — cookie, first-party, 30 days, SameSite=Lax. Records that you affirmed the two researcher statements at the gate. Its value is the single character 1.
- al_cart_v1 — local storage, not a cookie, kept until you clear it. Holds the items in your order. It is never sent to us with a request; it leaves your device only when you submit an order.
- al_cart_session_v1 — local storage, not a cookie, kept until you clear it. A random id with no personal information in it. Used to record an unfinished order against that id, a few seconds after you change what is in it — see above.
- Taboola's tracking script — third-party, loaded on every page to support the advertising described above. It is not a cookie we set; Taboola may set its own cookies or similar identifiers under its own domain to do this, governed by Taboola's privacy policy, which is why we cannot list them here by name.
- Session cookies set by our authentication provider — set when you sign in, removed when you sign out. If you never sign out they persist so that you are not asked to sign in again, for up to roughly thirteen months on the provider's default settings. They are what keeps you signed in from one page to the next.
- A short-lived sign-in cookie holding a one-time code verifier — set when a sign-in that round-trips away from this site starts (an emailed link, or a provider sign-in), used once when it completes, then cleared. It exists so the completion can be tied to the browser that started it.
Why there is still no cookie banner
Consent-banner rules generally target advertising, cross-site tracking, and selling or sharing data with other companies. Most of what is on this page is none of that. Taboola is the one real exception: it is advertising, and sharing a visit with it is the kind of thing several U.S. state privacy laws call a "sale" or "share" of personal information, whether or not money changes hands. Those laws respond to it with an opt-out right rather than a requirement to ask your permission before you ever load the page — see our privacy policy for how to exercise that right today, while we build a dedicated control for it.
The unfinished-order record is a separate, smaller case, and the reasoning above does not apply to it the same way: it is used by us, for the single purpose stated, and never leaves this business. It is not a cookie in the technical sense either — it lives in local storage, which a browser does not send with every request the way it does a cookie, and is written only when you take an action (changing your order, typing an email) rather than the moment you land on a page. That said, this is a newer and less settled area than the researcher-gate cookie below, and we would rather say so plainly than overstate our own confidence. If your jurisdiction takes a stricter view of it than we have assumed here, the section below tells you how to stop it — and you do not need our permission to use it.
al_researcher_verified is set by this site's own code running in your browser, which means scripts on this site can read it. That is a consequence of how it is set, not a route to anything about you — it holds the character 1. The session cookies are the opposite case: they are set by the server and marked httpOnly, so no script on the page can read them at all.
You do not have to take our word for any of this. View the page source, or open the network panel in your browser and reload. Every request goes to this site, to Taboola for the one script described above, or — once you choose to pay — to the payment processor's own site.
Clearing them, and what happens if you do
You can clear or block all of it in your browser settings, at any time, without asking us. Nothing here resists it and nothing is restored behind your back.
If you clear al_researcher_verified you will see the researcher gate again on your next visit. If you clear local storage your saved order is emptied — and because it never left your device, there is no copy of it for us to restore. Clearing al_cart_session_v1, or simply declining to enter an email before you finish or abandon an order, means we have no way to follow up on it — a new id is generated the next time you add something, with no link back to the old one.