Cookies

What we set, and what we only set if you say yes

What we set

hb_basket

What is in your basket. Without it, your basket empties every time you open a new page. Fourteen days, or until you check out.

hb_customer

Keeps you signed in. Thirty days. It cannot be read by any script on the page, only by our server.

hb_oauth_state, hb_oauth_verifier, hb_oauth_return

Set only while you are signing in with Google or Apple, and deleted the moment you come back. They exist to prove the sign-in started here and not on somebody else’s page. Ten minutes.

What Stripe sets

On the checkout page only, Stripe sets its own cookies to spot fraudulent payments. They are part of taking a payment safely, which is why they sit in the same strictly necessary category. Stripe explains them in its own cookie notice.

Counting visits

We count page views so we can see which pages people actually use and which ones nobody ever finds. It is anonymous, it sets no cookie, and it does not follow you to any other website. We cannot tell who you are from it and neither can anybody else.

UK law allows this without asking first, as long as the only purpose is statistics to improve the site and as long as you are given an easy way to say no. Here is the easy way to say no.

Google Analytics, only if you say yes

With your permission we use Google Analytics 4 to understand how people find the site and move through it: which pages they visit, roughly where in the world they are, what device they use and whether they get as far as an enquiry or an order. It helps us decide what to improve. We do not use it to identify you, and we do not switch on Google’s advertising features or Google signals. Google keeps the data for 14 months, then deletes it.

If you accept, Google Analytics sets these cookies on our domain:

_ga

Tells one visit from another by giving your browser a random identifier. Two years.

_ga_E37LMJ9FZQ

Keeps track of the current session for our site. Two years.

Google acts as our processor for this: it handles the data on our instructions, under its data processing terms. Google may process it outside the UK, including in the United States. Those transfers rely on the UK’s adequacy regulations for the UK Extension to the EU–US Data Privacy Framework, under which Google is certified, and on the UK International Data Transfer Addendum built into Google’s terms. Google Analytics 4 does not log or store IP addresses; it uses them briefly to estimate your rough location and then discards them. All data sharing with Google is switched off, so Google does not use it for its own products or advertising.

If you say no, or simply ignore the banner, Google Analytics does not load and none of these cookies are set. Your choice is remembered in your browser for six months, after which we ask again.

Changing your mind

You can change your choice at any time, as easily as you made it. Use the button below or the “Cookie settings” link at the bottom of every page. If you withdraw your permission, Google Analytics stops and we delete its cookies from your browser.

What we do not do

• No advertising or retargeting pixels.
• No social media tracking buttons.
• No selling or sharing of anything about you.
• No profile of you built across sites.

If we ever start advertising, we will ask for that separately. Saying yes to analytics is not saying yes to adverts.

Clearing them yourself

Every browser lets you delete cookies and block new ones, usually under privacy settings. Blocking ours will stop the basket and the login working, which is the trade you are making.

What we do with the information itself is in the privacy notice.

Last updated 27 September 2026.