Why we don't ask for consent
Consent is needed for cookies that aren't strictly necessary: statistics, advertising, profiling. There are none here, so there is nothing to consent to — and you're spared the window you have to close before you can read anything. If we ever added something that followed you around, that window would appear, and it would appear before the cookie was written.
Our own cookies: none
This site sets no cookies of its own. No statistics, no audience measurement, no advertising. Not even a cookie for the language: which language to show you is decided from the page address and, on your first visit, from the preferences your browser announces by itself.
What stays in your browser
To make ordering work we use the browser's local storage, which is not the same thing as a cookie: it stays on your device and doesn't travel to our servers with every request. There are four entries: 'cg-cart' holds the pieces you've chosen, 'cg-contact' the details you type when confirming, 'cg-delivery' whether you'd rather have it posted or collect it, and 'cg-pending' your order number whilst payment is going through, so you don't lose your pieces if the page closes.
All of it is first-party technical information that exists because you asked for it, by putting something in your order: for this the law requires no consent (art. 5(3) of the ePrivacy Directive). None of it recognises you from one site to the next, and none of it reaches us on its own: when you pay, we are the ones who send the data, explicitly.
Stripe's cookies
Payment is handled by Stripe, and its script is loaded as soon as you open the shop, so the payment buttons are ready by the time you come to confirm. From that moment three technical Stripe cookies exist: '__stripe_mid', which lasts a year, and '__stripe_sid', which lasts half an hour, on our own address, plus an 'm' cookie on Stripe's domain, which lasts a little over a year. They recognise the device and prevent fraud. We don't read them and we get no statistics out of them: how Stripe handles them is set out in its own notice at stripe.com/privacy.
Cloudflare
The site is served through Cloudflare, which delivers it and protects it from attack. The responses it sends today carry no cookie at all. To stop automated traffic Cloudflare may set technical cookies of its own, for instance '__cf_bm', which lasts half an hour: those are security cookies, they profile nobody, and we don't use them for anything else.
How to wipe the lot
From your browser: the privacy settings let you delete cookies and site data, for this site or for all of them, and you can browse in a private window. If you clear this site's data the order you were putting together empties — the pieces aren't lost, you just add them again — whilst orders already paid for stay recorded with us and you'll find them in your email.
For everything else — which data we collect, who we pass it on to, how long we keep it — there's the privacy notice, in the footer below. Last updated: 8th September 2026.