Restora's intended setup keeps cookies and similar technologies minimal, with no optional analytics, advertising or cross-site tracking until affirmative opt-in. This draft describes the required approach; the live implementation and cookie inventory must be verified before launch.
Storage used by the current preview
Restora uses restora-bag-v1 in browser local storage to remember selected products and quantities, with a 30-day logical expiry. restora-orders-v1 stores private order-access tokens on this device for 30 days. restora-cleared-orders keeps the most recent 30 processed-order tokens to prevent a confirmed order from clearing your bag twice; it remains until browser storage is cleared. These are first-party local-storage items, not advertising cookies. The application does not enable optional analytics or marketing. Stripe hosted Checkout uses its own payment and security technologies; review its privacy information at https://stripe.com/privacy. Hosting services may also perform necessary security and operational processing.
What cookies and similar technologies do
Cookies are small pieces of information stored by a website in your browser. Similar technologies include local storage, pixels and scripts that can store or access device information. They can support requested functions or, when optional, measure visits and support advertising.
This policy covers these technologies together. Security and hosting logs may involve technical personal information without using tracking cookies; the Privacy Policy must describe those actual data practices separately.
Necessary functionality only by default
The planned default allows only storage genuinely needed for a service you request, such as maintaining a basket, supporting a secure session or remembering your privacy choice. The site should avoid storage that is not needed. No optional analytics, marketing pixel, behavioural profiling or cross-site tracking may run before affirmative opt-in.
Required before launch: justify each necessary technology against its actual purpose. A technology is not necessary merely because it is useful to the business or supplied by a provider. Verify that embedded content and third-party scripts follow the same default.
Optional technologies and consent
If optional technologies are introduced, explain their purposes and providers before asking for consent. Optional categories must be off by default. Accepting, rejecting and customising optional use must be clearly available without preselected choices. Continuing to browse or closing a notice is not opt-in.
Declining optional tracking must not prevent normal browsing or purchasing. If the site uses only genuinely necessary technologies, do not imply that optional tracking is active or request meaningless consent.
Required before launch: audit the actual site, block optional scripts until consent and document consent choices where needed. No analytics or advertising provider is named or authorised by this draft.
Changing your choice
If optional technologies are offered, provide an easily accessible on-site cookie-preferences control so you can withdraw or change consent as easily as you gave it. Withdrawing consent must stop the relevant optional activity and remove associated storage where technically possible. Withdrawal does not undo lawful processing that already occurred.
Browser settings can also block or remove cookies, although blocking necessary storage may affect a requested function. Browser settings are not a substitute for the site's consent controls.
Required before launch: implement and test the preferences control and synchronise withdrawals with affected providers. Do not display a non-working preferences link.
Separate hosted checkout
Checkout is intended to use a separate secure hosted commerce provider. Its checkout environment may use necessary storage for basket continuity, session security, payment and fraud prevention, and it may provide its own cookie notice and controls.
Required before launch: name the provider, link its relevant notices and audit the handoff, checkout scripts and any provider-controlled optional tracking. A redirect to hosted checkout is not blanket consent to analytics or advertising, and choosing a hosted provider does not itself prove compliance.
Cookie inventory and review
Required before launch: publish the name or identifier, provider, purpose, category and actual lifetime of each cookie or similar technology, including whether it is session-based or persistent. Verify both the Restora site and hosted-checkout handoff, and record any third-party access or data sharing.
No cookie names, providers or durations have been invented for this draft. Add an effective date and update the inventory and consent controls before introducing new optional technologies. The Privacy Policy explains the related personal-information requirements.