This Cookie Policy explains which cookies allthe sets in your browser, why we set them, and how long they last. We keep this list up to date as the platform changes.
What are cookies?
Cookies are small text files stored in your browser when you visit a website. They allow the site to remember your session and preferences, protect against attacks, and understand how the site is performing.
How consent works
We use CookieFirst to manage cookie consent on allthe.com. Strictly necessary and preference cookies are set without consent because the site cannot work properly without them. Analytics and advertising cookies are off by default and are only set if you accept those categories in the consent banner. You can change or withdraw your choice at any time through the cookie settings link. CookieFirst stores your choice in its own consent cookies (names beginning "cookiefirst").
Strictly necessary cookies
Signing in
__Secure-authjs.session-token — your login session, stored as an encrypted JSON Web Token (sometimes split across numbered parts, e.g. …session-token.0, .1). It lasts up to 30 days and is refreshed while you keep using the platform; an idle session lapses after 30 days. Signing out deletes it. It is HttpOnly (not readable by JavaScript) and Secure (sent only over HTTPS).
__Host-authjs.csrf-token — Cross-Site Request Forgery protection, compared server-side on form submissions. Session duration; no personal data.
__Secure-authjs.callback-url — temporarily stores the page you were heading to before being asked to sign in, so we can send you back there afterwards. Session duration.
Shopping and checkout
cc_cart — keeps your catalogue shopping cart together between visits. 30 days. sf_cart_… — the same for each storefront shop you browse. 30 days.
co_acc_… — a short-lived access grant set after you verify your email on a guest checkout or quote link, scoped to that link only. It expires with the link.
Shop access and gates
storefront_unlock_… — remembers that you entered a password-protected shop's password. 7 days. storefront_gate_… — remembers the email address you used to unlock an email-gated shop, in a signed value. 30 days. sf_gift_… — lets a gift link you opened stay claimed while you complete it. 24 hours. portal_bypass — lets invited visitors through when the site is in preview or maintenance mode. 7 days.
Forms and connections
atw_withdrawal_lookup — holds the name, email and order reference you enter on the order-withdrawal form while you complete it. 30 minutes. etsy_oauth_state — protects the Etsy shop-connection handshake. 10 minutes. gc_flow_… — protects the GoCardless bank-mandate setup flow. 30 minutes. allthe-embed — lets the dashboard render inside the Shopify admin when you open it from there. 30 minutes.
Security
We use Cloudflare Turnstile on sign-in, registration and contact forms to block bots. Cloudflare, which also protects the site as a whole, may set its own security cookies (such as __cf_bm) to tell humans and bots apart.
Preference cookies
_mkt — your chosen language and currency. 1 year. _vat — whether prices are shown including or excluding VAT. 1 year. _ship_to — the country you asked us to quote delivery for. 1 year.
Analytics cookies (only with your consent)
Google Analytics — helps us understand how visitors use allthe.com (_ga and _ga_… cookies, up to 2 years). These are denied by default and set only after you accept analytics in the consent banner; we use Google Consent Mode to enforce that.
Pendo — product analytics inside the signed-in dashboard only, used to understand which features our customers use and to improve them. It is linked to your account and never runs on the public site or on storefronts.
Advertising cookies (only with your consent)
These are off by default. They are set only if you accept the advertising category in the consent banner, and our tags are held back until you do. If you decline, or simply never answer the banner, none of them are set.
Meta (Facebook and Instagram) — _fbp (3 months) and, if you arrive from a Meta advert, _fbc (3 months). Used to measure whether an advert led to a visit or an order, and to show you our adverts on Meta's platforms.
Google Ads — _gcl_au (90 days), set by Google's conversion tag to measure whether an advert led to an order.
Reddit — _rdt_uuid (90 days), used to measure whether a Reddit advert led to a visit or an order.
Microsoft Advertising (Bing and Copilot) — _uetsid (1 day), _uetvid (13 months) and MUID (13 months), set by Microsoft's tracking tag to measure whether an advert on Bing or Copilot led to a visit, a sign-up or an order. The tag is not loaded at all until you accept the advertising category.
We do not send your name, email address or any other personal detail to these advertising platforms, in plain or hashed form. They receive the fact that a visit or an order happened and what it was worth, not who you are.
Payment provider cookies
Stripe — our card-payment provider sets __stripe_mid (1 year) and __stripe_sid (30 minutes) on pages where a payment form loads. Stripe uses them for fraud prevention, not advertising.
Attribution cookies
allthe_attr — if you arrive from one of our adverts, this records which campaign and advert brought you, so that a resulting sale or sign-up can be attributed to it. 90 days, first-party, and set only if you accept the advertising category. atl — if you arrive via an allthe.cc short link, this records which link brought you so that a resulting sale or sign-up can be credited to the person who shared it. 30 days, first-party. pitch_v — a pseudonymous identifier used only on private pitch pages so your likes and comments stay yours. 180 days.
Error monitoring
We use Sentry to monitor errors and performance. Sentry stores a small amount of data in your browser's sessionStorage (not cookies) to correlate error reports with a browsing session, and records a replay of a small sample of sessions solely to help us diagnose and fix technical issues. It is never used for advertising.
Local storage
Some features save data in your browser's local or session storage rather than cookies — for example unsaved design drafts in the customiser, your preferred size-guide units, and notices you've dismissed. This data stays on your device and is not sent to us as tracking.
What we do not do
We do not sell your personal information, and we do not share cookie data with data brokers. Analytics and advertising cookies are set only if you accept them, and the advertising platforms listed above receive measurement data about visits and orders, never your name or email address.
Managing and deleting cookies
You can change your analytics and advertising choices at any time via the cookie settings link on the site, and you can view, block or delete cookies through your browser settings. Blocking the session or CSRF cookies will prevent you from signing in; blocking the cart cookies will empty your basket between visits.
Changes to this policy
If we add new cookies we will update this page and revise the Last updated date. We will not add non-essential cookies without updating this policy and, where consent is required, asking for it first.
Contact
Questions about cookies or this policy? Contact us via our contact page or at legal@allthe.com.