1. What these technologies are
Cookies: Small files a website asks your browser to store, and which the browser sends back on later visits. They are how a site remembers that you are signed in, or what is in your cart.
Local storage: A place in your browser where a site can keep a small amount of information on your device. We use it to hold your cart and address between visits so they are not lost when you close the tab.
We do not use tracking pixels in emails or on the website, and we do not use advertising cookies or share data with advertising networks.
2. Strictly necessary
These run whenever you use the site, because it cannot work without them. They are not used to track you across other websites, and consent is not asked for them.
access_token, refresh_token: Keep you signed in and let the app renew your session without asking for your password again. Set once you sign in, removed when you sign out.
geolocation: Remembers the country you selected, so prices, units and water-quality sources match where you are.
tdsbot_consent: Records the choice you made in the cookie banner, and when you made it, so we do not ask again on every page. Kept for twelve months.
Local storage: state, state-version: Hold your cart, delivery address and country between visits, and the version they were written by, so stale data can be discarded after a release. These are the only things stored on a page you simply read: no cookie at all is set until you sign in, open a form, or reach checkout.
G_ENABLED_IDPS: Set when the sign-in page loads, by the Google sign-in button, so that choosing Google works. Apple sign-in is offered the same way. Neither is used unless you take that route.
Google reCAPTCHA (_GRECAPTCHA): Protects the sign-up, sign-in and support forms from automated abuse. It is provided by Google and is loaded when one of those forms is shown, not before. Without it those forms cannot be submitted safely, so it runs as a security measure rather than by consent.
Stripe (__stripe_mid, __stripe_sid): Set by our payment processor to process the payment and detect fraud. The Stripe code is loaded only when you reach checkout, so on every other page these are not set at all.
3. Analytics — only if you agree
We use Google Analytics 4 to count visits and see which pages are read, so we know what to improve. It is off until you turn it on: until then the Google tag is not loaded and no analytics cookie is written.
_ga, _ga_JHPJG9QFK1: Set by Google Analytics to tell one browser from another and to group page views into a visit. They do not carry your name or email. Kept for up to two years, or until you clear them.
We have Google Consent Mode switched on, which means that when you have not agreed, the tag is told so and stores nothing on your device.
4. Changing what you allow
Use the button below to see the categories again and change your answer. Refusing analytics is one click, the same as accepting, and you can change your mind as often as you like.
You can also block or delete cookies in your browser settings. Blocking the strictly necessary ones will stop you signing in, and may stop checkout from working.
If you would rather opt out of Google Analytics everywhere, Google publishes a browser add-on that does that on every site you visit.
5. Changes to this policy
If we add a technology that needs your consent, or change what an existing one is used for, we will update this page and ask again through the banner rather than relying on an answer you gave to a different question.