Cookies

What the shop needs. We store your cart in your browser (sm_cart_v1, in local storage) until you clear it or finish checkout. We store your privacy choice (sm_consent_v1 in local storage and the cookie sm_ads_consent, which lasts one year) so that it is remembered and applied at checkout. This storage is strictly necessary to run the shop and needs no consent. For one visit we also keep the two-letter code of the country your connection comes from (sm_geo_v1, session storage, cleared when you close the tab). It is used only to decide whether the ad measurement pixel may load before you choose (the rule below), so that it stays off for visitors outside the United States, and it is never sent anywhere. If you open a link that carries a discount or creator code (?code=), we keep that code for the visit (sm_code_v1, session storage, cleared when you close the tab) so that the cart page can fill it in for you; you can change or delete it there, and it is sent to us only when you check out, to apply the discount and credit the creator whose link you used. It is strictly necessary to give you the discount you clicked for. Cloudflare, which hosts the shop, may set its own short-lived security cookie (such as __cf_bm or cf_clearance) if its bot protection checks a visit; that cookie is strictly necessary to keep the site secure. The online withdrawal form on the Refunds and Returns page uses Cloudflare Turnstile, a bot check that loads from challenges.cloudflare.com only when you open the form; Cloudflare may use its own strictly necessary security cookies for it (listed in Cloudflare's cookie policy), and it is not used to profile you or target ads. The checkout page is hosted by Stripe and runs under Stripe's own privacy policy (https://stripe.com/privacy).

Ad measurement with the ChatGPT Ads pixel. Our ads on ChatGPT use a measurement pixel from OpenAI. While it is on, it runs on every page of the shop except the review and newsletter pages we link from our emails (their links carry a private code, so they never load it). So it records your visits and orders whether or not you came from one of our ads, and it tells us whether a click on an ad ends in an order.

• If you are in the United States, the pixel is on when you arrive and the footer tells you so. Choose "Privacy choices" in the footer and press Decline to switch it off. It then stays off on this device, and your order is not reported to OpenAI. If your browser sends a Global Privacy Control signal, the pixel stays off as it would after Decline, and the bar lets you press Accept if you want it on. If your browser blocks both local storage and cookies, so that no choice can be remembered, the pixel does not load until you press Accept.
• If you are anywhere else, or we cannot tell where you are, nothing loads until you press Accept in the bar at the bottom of the page.
• When it is on, the pixel sets two cookies on our domain: __oppref, which lasts 30 days and links a click on an ad to an order, and __obref, a random browser reference that lasts 365 days. Pressing Decline deletes them.
• When it is on, our shop also keeps two notes in session storage, which your browser clears when you close the tab: sm_ads_pending, the mug you just added to your cart, so that the add-to-cart event can be sent from the next page, and sm_ads_done_ followed by your checkout reference, so that your order is reported only once.
• We work out your country from your connection when the page opens, and we record your country and your choice with your order so that the server-side order report follows it.

If we add Meta or Pinterest tags, they load only after you press Accept, for every visitor, and we will update this section first.