Cookie Policy

The categories we use

Our Privacy Policy describes four categories of cookies and similar technologies. Here is what each currently means on this site:

• Strictly necessary — your shopping cart and wishlist, and the security of the checkout handoff. These cannot be switched off; blocking them stops the shop working.
• Functional — remembering what you have saved so it is still there when you come back to a page.
• Analytics — how the store is used, so we can improve it. Ours is first-party and described in full below.
• Advertising — measuring campaigns and showing relevant ads on other sites.

You can manage your choices on our Your Privacy Choices page or in your browser settings.

What we store on your device

Four items of our own, all in your browser’s own local storage rather than in cookies:

• hearthsweep.cart.v1 — the contents of your shopping cart. No name, email, address or payment detail.
• hearthsweep.wishlist.v1 — the products you have saved. Product identifiers only.
• hearthsweep.sid — a random session identifier used for analytics. It is held in session storage, so it is discarded the moment you close the tab, and it is not linked to your name, email or order.
• hearthsweep.conv.<order number> — set on the order-confirmation page so that refreshing it does not report the same order to Google Ads twice. Session storage, discarded when you close the tab.

Your cart leaves your device at one moment only: when you press checkout, so we can price the order and create a payment session.

Google also sets advertising cookies of its own through the tag described under Advertising below. Those are Google’s cookies, not ours.

How our analytics works

Our own analytics is first-party. Events are recorded by our own server on our own domain, they set no cookie, and we do not run Google Analytics or a Meta pixel. Nothing collected here is passed to an advertising network. The Google Ads tag described below is a separate thing that runs alongside it, and the two do not share data.

What an event contains: the type of action (a page view, a product view, an add to cart, a checkout start), the product involved, the price, the page path, the referring site’s domain, and the random session identifier above.

What it never contains: your name, email address, postal address, phone number or any payment detail. Completed orders are recorded from the payment confirmation and carry only the order number and total.

We use this to see which products people look at, where the checkout loses people, and which pages are worth improving.

Opting out of analytics

If your browser sends a Global Privacy Control or Do Not Track signal, we collect no analytics events from you at all. Nothing is queued and nothing is sent. Most privacy-focused browsers and extensions send one of these by default, and you can usually switch it on in your browser’s privacy settings.

This is a genuine opt-out, not a preference we record — the collection simply does not run.

Advertising: the Google Ads tag

We advertise this store on Google, so every page loads Google’s advertising tag (googletagmanager.com). It is the only third-party script the storefront loads, and it exists for two purposes: to tell us which ads actually lead to an order, and to let Google show our ads to people who have visited the store. To do that Google sets its own cookies on your device and receives your IP address, the page you are on, and the referring page.

On the order-confirmation page, and only there, we send Google the order number and the order total so a sale can be matched back to the ad that produced it. We do not send your name, email address, postal address, phone number or any payment detail at any point.

Under California, Colorado, Connecticut, Texas and several other state laws this use of an advertising tag counts as a “sale” and as “sharing”, even though no money changes hands for your data. Section 3 of our Privacy Policy says the same thing.

How to switch it off: send a Global Privacy Control signal. We read it before the tag loads and set Google’s consent flags to denied for that visit, so the advertising cookies are not set and no personal data is used for ads. Most privacy-focused browsers and extensions send GPC by default, and it is listed at globalprivacycontrol.org. You can also email support@hearthsweep.store with “Do Not Sell or Share”, or block third-party cookies in your browser.

Third parties

Payment is taken in a Stripe form embedded in our checkout page, so you stay on hearthsweep.store throughout. That form is served by Stripe and sets Stripe’s own strictly necessary cookies, which carry your checkout session and support Stripe’s fraud checks. Those cookies are Stripe’s, under Stripe’s own policies; we cannot read them or switch them off, and payment cannot be processed without them. Your card details go straight to Stripe and never reach our servers.

Vercel, which hosts this site, keeps standard server request logs — IP address, time, URL requested, status code and user agent. That is a server-side record, not something stored on your device.

Clearing what we store

Everything we keep on your device can be removed from your browser, and there is nothing on our side to delete. The same steps clear Google’s advertising cookies:

• Chrome and Edge: Settings, then Privacy and security, then Delete browsing data, and choose Cookies and other site data.
• Firefox: Settings, then Privacy & Security, then Cookies and Site Data, then Manage Data, and remove hearthsweep.store.
• Safari: Settings or Preferences, then Privacy, then Manage Website Data, and remove hearthsweep.store.

What breaks: your cart and wishlist empty. Nothing else changes, and an order you have already placed is unaffected — that record sits with us and with Stripe, not in your browser.

Questions

If you think this page overstates or understates what the site does, tell us at support@hearthsweep.store and we will correct it. A statement that does not match the site is worse than no statement at all.