Cookie policy
Every cookie this site sets, what each one is for, and how long it lasts. Four keep the shop working. Two are analytics, and those stay off until you accept them.
Last updated: 4 October 2026
1. What we set, and what we ask about
A cookie is a small file a site stores in your browser. We use as few as we can get away with, and we sort them into two groups that are treated very differently.
- Strictly necessary cookies keep you signed in, remember your basket, and let a guest see their own order confirmation. The shop cannot work without them, so they are set without asking. UK law (the Privacy and Electronic Communications Regulations 2003, regulation 6) allows exactly that, and no more.
- Analytics cookies tell us which pages are used. They are not necessary, so they are off until you say yes. Nothing loads, and no analytics cookie is set, unless you choose Accept in the banner.
We set no advertising cookies, run no social media pixels, and have not enabled Google Signals or any advertising feature. Nobody is tracked across other websites from here.
The emails we send you carry one small tracking image, which tells us when the email was opened and nothing else; it sets no cookie and is described in the privacy policy. Blocking images in your mail app blocks it.
2. Strictly necessary cookies
| Cookie | What it does | How long |
|---|---|---|
| better-auth.session_token | Keeps you signed in to your account. Also appears with a __Secure- prefix on the live site. Deleted when you sign out. | 7 days, renewed while you keep using the site |
| pepts_cart | Identifies your basket, so it survives a refresh and follows you into your account when you sign in. It holds a random identifier, not what is in the basket. | 90 days |
| pepts_orders | Lets a guest reopen their own order confirmation without an account. Holds only recent order numbers. | 30 days |
| pepts_ref | Only set if you arrive through a partner's referral link, which promises a discount. It holds that partner's discount code and nothing else, so checkout can apply the discount you followed the link for. We also use it to credit the partner for the order. | 30 days |
| pepts_consent | Remembers your answer to the analytics question, so you are not asked on every page. Set whichever way you answer. | 6 months |
| pepts_gate | Only exists on a password-protected preview of the site, and remembers that the password was entered. Not set on the public shop. | 90 days |
The first four are httpOnly, meaning no script on the page can read them, and all of them are SameSite=Lax, so they are not sent along with requests started by another site.
3. Cookies we set without asking, and why
Two cookies are neither strictly necessary nor covered by the analytics question, and we would rather say so than file them under either.
| Cookie | What it does | How long |
|---|---|---|
| pepts_visit | A random identifier. Against it we record the page you arrived on, the site or advert that sent you there, the pages you view here, and your browser, screen size and rough location (the country and city your connection resolves to; never your IP address). It tells us which of our pages and adverts lead to baskets. It is not read by anybody else and is not used to show you advertising elsewhere. | 30 days |
| pepts_psm | Only set if you arrive through a link on PeptideSupermarket, the price comparison site. It holds the reference on that link and nothing else, so that if you order, we can tell them the order came from them and pay the commission we agreed. It is never sent to them, and no script of theirs runs on this site. | 90 days |
Both are httpOnly and SameSite=Lax like the others. If a Google advert brought you here and you go on to pay for an order, we tell Google Ads that its advert led to an order of that value, under the order number, so we can see which adverts work; no name, address or e-mail goes with it.
If PeptideSupermarket sent you here, or sent you here before and you order again, we tell them the order number, whether it has been paid, what the goods cost, the reference on their link if you still have it, and a fingerprint of your e-mail address made with SHA-256, which lets them recognise a repeat order without being given the address. That is how the commission we agreed with them is worked out. Nothing else goes to them: not your name, your address, what you bought or anything about your visit, and an order from somebody they did not send is never reported at all.
4. Analytics cookies, only if you accept
We use Google Analytics 4 to count visits and see which pages get read. It tells us that a page was viewed on a phone somewhere in Manchester; it does not tell us who you are, and we do not connect it to your account or your orders. The same script carries our Google Ads tag, which is how we learn that an advert led to an order, and it loads under the same rule: only if you accept.
| Cookie | What it does | How long |
|---|---|---|
| _ga | Distinguishes one browser from another so a returning visit is not counted as a new one | 2 years |
| _ga_<id> | Holds the session state for our specific analytics property | 2 years |
| _gcl_au | Set by the Google Ads tag so that an order placed after clicking one of our adverts can be told apart from one that was not | 90 days |
If you decline, or simply never answer, none of these is ever created and the Google script is never downloaded. If you accept and then change your mind, we delete them from your browser and stop loading the script from your next page view.
6. Videos in the guides, only if you press play
A research guide can show a video hosted on YouTube, made by somebody else and credited to them. Until you press play it is a picture of ours, and your browser has not contacted YouTube at all. Pressing play loads YouTube's player from its privacy-enhanced address, youtube-nocookie.com, and from then on whatever that player stores in your browser is YouTube's, under YouTube's own privacy policy rather than ours. We receive nothing from it.
7. Changing your mind
Open to change your answer, or to make us forget it and ask again. The link is in the footer of every page too.
You can also clear or block cookies in your browser settings, which works for any site, not just ours. Blocking the strictly necessary ones will sign you out and empty your basket, which is not us being difficult: those cookies are the sign-in and the basket.
Google publishes a browser add-on that opts you out of Google Analytics everywhere: tools.google.com/dlpage/gaoptout.
8. Questions, and changes to this page
What we do with the data behind these cookies, and the rights you have over it, are in the privacy policy. Anything else, email support@pepts.co.uk.
If we add a cookie, this page changes before it does, and the date at the top moves with it. Adding anything that is not strictly necessary would mean asking you again.