Cookie Policy

A cookie is a small text file that a website asks your browser to store and send back on later requests. Cookies let a site recognise the same browser from one page to the next — which is what makes staying signed in, or keeping a cart, possible at all.

“Similar technologies” do comparable jobs by other means. This policy covers all of them:

• First-party cookies — set by theoryslabs.com.
• Third-party cookies — set by another domain whose content is embedded in a page, such as a payment provider’s form.
• Session cookies — deleted when you close your browser.
• Persistent cookies — kept until they expire or you delete them.
• Local storage — a browser store that holds data until the site or you clear it. It is not sent automatically with every request the way a cookie is.

This policy explains what this Site actually uses. How the resulting information is handled is described in the Privacy Policy.

That is a statement about how the Site is built, not a promise about the future. If we ever add analytics or advertising technology, we will update this policy and the Privacy Policy first, and put a consent mechanism in place before any such technology is allowed to run.

These cannot be switched off through a preference control, because without them the Site cannot do what you have asked it to do — sign you in, hold your cart, or take an order. They are not used to profile you or to track you across other websites.

Scroll the table sideways to see every column.

Security tokens that protect our forms against cross-site request forgery are generated per form and tied to your session; they are not stored as separate cookies.

If you are a site administrator, WordPress also sets interface-preference cookies (wp-settings-…) in the admin area. Those are irrelevant to customers.

Functional cookies remember optional preferences — a chosen layout, a dismissed banner, a saved filter. The Site currently sets none beyond the strictly necessary entries in section 3.

The research-use acknowledgement in that table is arguably a preference of this kind, but we treat it as strictly necessary: it records a legal acknowledgement we require before you use the Site, and without it you would be asked to acknowledge the notice on every page.

None. The Site runs no third-party web analytics, product analytics, session-recording, heat-mapping or A/B testing service, and sets no cookie for any such purpose.

What we do have is ordinary web server logging, which is not a cookie and does not involve one: our server records the requests it receives, including IP address, timestamp, URL, response status and user-agent string. That is described in the Privacy Policy.

Our store platform’s own usage-statistics option is currently enabled, which sends non-personal information about the store’s configuration and use to the platform vendor (Automattic). It is a server-side setting and does not set a cookie in your browser.

None. The Site contains no advertising pixel, conversion tag, remarketing tag, social-media pixel, tag manager or audience-building script. We do not sell or share personal information for cross-context behavioural advertising, and there is no advertising technology here that could do so. See the sale and sharing section of the Privacy Policy.

Adding any such technology would require this policy and the Privacy Policy to be updated, and a working consent mechanism to be in place first.

Two third parties are involved in delivering pages or payments, and are therefore capable of receiving information from your browser:

• Our payment processor (Clover) — serves the payment fields at checkout and may set its own cookies or storage in that context, as noted in section 3.
• Google LLC — supplies the web fonts the Site loads. Requesting a font file sends your IP address and user-agent string to Google’s font service. To our knowledge that service does not set cookies for the font files themselves, but the request itself is a third-party connection you should be aware of.

No other third-party service is embedded in the Site: there is no chat widget, no embedded video player, no social sharing script, no comment service and no advertising network. Where the Site links out to another website, that site’s own cookie practices apply once you follow the link.

Each entry’s duration is in the table in section 3. In summary: cart cookies last for the browser session; the WooCommerce session cookie lasts 2 days for a guest and 7 days once you are signed in; the sign-in cookies last for the browser session, or up to about 14 days if you ask to stay signed in; the research-use acknowledgement is kept in local storage until cleared, with a cookie fallback of up to 1 year.

Deleting cookies for this Site signs you out and empties your cart. Clearing local storage also clears your research-use acknowledgement, so the notice will be shown again on your next visit.

There is no consent banner on this Site, and no preference toggles, for a specific reason: there is nothing optional to consent to. Every technology listed in section 3 is strictly necessary, and laws that require consent for cookies exempt strictly necessary ones. We would rather show you an accurate inventory than a consent dialog that implies choices we are not actually offering.

You remain in control by other means:

Browser controls

Every major browser lets you see, block and delete cookies and local storage, either generally or for a specific site, usually under Settings → Privacy. Blocking or deleting the entries above will sign you out, empty your cart and prevent checkout from working, because the Site has no other way to keep that state. Private or incognito browsing discards them when the window closes.

Re-showing the research-use notice

To see the research use only acknowledgement again, clear this site’s local storage and cookies in your browser, or use a private window. We also re-present the notice to everyone whenever the acknowledged wording changes materially.

Global Privacy Control and Do Not Track

We treat the Global Privacy Control signal as a valid opt-out of the sale or sharing of personal information under the laws that recognise it. At present it has nothing to act on here, because there is no sale, no sharing and no advertising or analytics technology on the Site. We do not act on Do Not Track headers, for which no common standard exists. Both are covered in the Privacy Policy.

If this ever changes

Before we add any analytics, advertising or other non-essential technology, we will update this policy, update the Privacy Policy, and provide a consent mechanism and preference control that genuinely governs whether it runs — including honouring an opt-out preference signal such as Global Privacy Control.

How we use the information these technologies generate — including retention, disclosures and your privacy rights — is set out in the Privacy Policy. Your use of the Site is governed by the Terms of Service.

Questions about this policy, or about anything you see in your browser’s storage for this Site, can be sent to support@theoryslabs.com.