Cookie Policy

1. What we set, and what we ask about

A cookie is a small file a site stores in your browser. We use as few as we can get away with, and we sort them into two groups that are treated very differently.

Strictly necessary cookies keep you signed in, remember your basket, and let a guest see their own order confirmation. The shop cannot work without them, so they are set without asking. UK law (the Privacy and Electronic Communications Regulations 2003, regulation 6) allows exactly that, and no more.
Analytics cookies tell us which pages are used. They are not necessary, so they are off until you say yes. Nothing loads, and no analytics cookie is set, unless you choose Accept in the banner.

We set no advertising cookies, run no social media pixels, and have not enabled Google Signals or any advertising feature. Nobody is tracked across other websites from here.

2. Strictly necessary cookies

Cookie	What it does	How long
better-auth.session_token	Keeps you signed in to your account. Also appears with a __Secure- prefix on the live site. Deleted when you sign out.	7 days, renewed while you keep using the site
pepts_cart	Identifies your basket, so it survives a refresh and follows you into your account when you sign in. It holds a random identifier, not what is in the basket.	90 days
pepts_orders	Lets a guest reopen their own order confirmation without an account. Holds only recent order numbers.	30 days
pepts_ref	Only set if you arrive through a partner's referral link, which promises a discount. It holds that partner's discount code and nothing else, so checkout can apply the discount you followed the link for. We also use it to credit the partner for the order.	30 days
pepts_consent	Remembers your answer to the analytics question, so you are not asked on every page. Set whichever way you answer.	6 months
pepts_gate	Only exists on a password-protected preview of the site, and remembers that the password was entered. Not set on the public shop.	90 days

The first four are httpOnly, meaning no script on the page can read them, and all of them are SameSite=Lax, so they are not sent along with requests started by another site.

3. Analytics cookies, only if you accept

We use Google Analytics 4 to count visits and see which pages get read. It tells us that a page was viewed on a phone somewhere in Manchester; it does not tell us who you are, and we do not connect it to your account or your orders.

Cookie	What it does	How long
_ga	Distinguishes one browser from another so a returning visit is not counted as a new one	2 years
_ga_<id>	Holds the session state for our specific analytics property	2 years

If you decline, or simply never answer, neither of these is ever created and the Google Analytics script is never downloaded. If you accept and then change your mind, we delete them from your browser and stop loading the script from your next page view.

4. Things that look like tracking and are not

Two parts of the site talk to the outside world without setting anything in your browser, and it is worth being clear about them.

Google Search Console tells us how the site appears in search results. It reads Google's own data about search, and collects nothing from your visit here. Its verification is a single meta tag in the page source.
The postcode finder at checkout sends the postcode you typed to our address-lookup provider so it can return the addresses on it. That is a server-to-server request. Your browser is not contacted by them, and no cookie is involved.

We also embed nothing: no YouTube players, no social widgets, no third-party fonts loaded from someone else's server. Fonts and scripts are served from this domain.

5. Changing your mind

Open to change your answer, or to make us forget it and ask again. The link is in the footer of every page too.

You can also clear or block cookies in your browser settings, which works for any site, not just ours. Blocking the strictly necessary ones will sign you out and empty your basket, which is not us being difficult: those cookies are the sign-in and the basket.

Google publishes a browser add-on that opts you out of Google Analytics everywhere: tools.google.com/dlpage/gaoptout.

6. Questions, and changes to this page

What we do with the data behind these cookies, and the rights you have over it, are in the privacy policy. Anything else, email support@pepts.co.uk.

If we add a cookie, this page changes before it does, and the date at the top moves with it. Adding anything that is not strictly necessary would mean asking you again.