Cookie policy
The least boring cookie explanation we could manage.
Last updated: 26 July 2026. This page describes the storage found in the current storefront code. It is implementation support, not legal advice.
Your choice comes first
Essential storage is on because the site needs to remember the choice you make here. Analytics are off by default. They do not load, initialise or capture events until you actively choose Analytics. Continuing to browse does not count as consent.
Current storage inventory
The table below is based on the actual code and configuration. It separates storage that the storefront needs from optional analytics. No advertising, social-pixel, affiliate-tracking or third-party media embed is configured in the audited storefront code.
| Name / technology | Category | Purpose | Lifetime |
|---|---|---|---|
| Cookie preferences in local storage | Essential | Stores the Analytics on/off choice and the time it was saved, so the banner can honour it. | Until you change the choice or clear browser storage. No fixed expiry is configured in code. |
room-type-answers in session storage | Functional / essential to the quiz flow | Temporarily holds the room-choice indexes when the quiz result is calculated in the browser. | Current browser tab/session. It is not a cookie and is not used for analytics. |
admin_token cookie | Strictly necessary, admin-only | Authenticates an authorised MadeThis admin-session link for the /admin area. It is not set for ordinary storefront visitors. | One hour, as configured in the middleware. It is HttpOnly and limited to /admin. |
| PostHog browser persistence | Analytics, consent only | The audited configuration uses memory persistence after Analytics consent. It is designed not to set a new PostHog cookie, local-storage item or session-storage item. | Current page memory only. Provider-side event retention is not configured in the repository and requires founder confirmation. |
What Analytics measures
If you opt in, PostHog is loaded to measure product views, the buy action, checkout start and a completed checkout's amount and currency. It does not automatically record page views, clicks or form entries in this configuration. The analytics event payloads intentionally exclude quiz answers, email addresses, account information, payment details, checkout-session IDs and order IDs.
The integration uses a temporary in-memory identifier during the consented page visit. The storefront does not decorate checkout URLs with analytics identifiers or campaign parameters. This reduces the link between analytics and the checkout flow, while still allowing a consented completion event without the customer's email or order identifier.
Changing your mind
You can reopen these controls from the footer, this page or the Privacy Policy. Turning Analytics off stops future analytics captures, resets the in-memory analytics client and attempts to remove legacy PostHog-looking cookies and browser-storage entries from an earlier configuration. Browser and third-party limits can mean we cannot erase data that has already been sent to a provider; use the privacy contact once it is added if you need help with a data-rights request.
Before adding anything new
Do not add a pixel, heatmap, session recording, affiliate tracker, social embed, advertising tag or a new analytics plugin until it has been audited, described here and placed behind the appropriate opt-in category. The current banner offers Essential and Analytics because no other tracker category is active in the audited code.
Founder/legal review needed
- Verify the live PostHog project's exact provider-side retention, processing location, transfer safeguards and enabled features.
- Confirm that deployment configuration has not introduced additional scripts or tags outside this repository.
- Recheck this inventory after any checkout, marketing, social, affiliate or embed change.