Cookie & Local Storage Policy

These elements are strictly necessary for the technical operation of online ordering and site security. They cannot be turned off.

• Shopping Cart Storage (cart): Remembers selected dishes, custom options and meal quantities while you build your order.
• User Session & Auth (auth): Keeps you securely signed in to your account and authorizes requests using security tokens.
• Order Type & Location (location): Stores your choice of takeaway vs home delivery and your verified delivery zone address.
• Live Order Tracking (wtp_last_order_*): Allows real-time order status display without requiring you to repeatedly log in.
• Consent Preferences (wtp_consent*): Saves your cookie preferences for 180 days. A random token links your decision to its server receipt. Pending requests are retained until synchronization, including withdrawal requests in wtp_consent_erasures.
• Stripe Payment Security (__stripe_mid, __stripe_sid): Fraud-prevention cookies set when loading the PCI-compliant Stripe checkout form.

These tools help us evaluate site traffic patterns, resolve navigation bottlenecks, and improve storefront speed.

• Google Analytics 4 (_ga, _ga_*): Monitors visitor counts, popular menu categories, and shopping flow completion rates.
• Microsoft Clarity (_clck, _clsk): Heatmaps and pseudonymous session replay, used to find where ordering becomes difficult. Form fields (name, email, phone, address, payment) are masked in your browser before anything is sent and are never recorded. Data is processed by Microsoft (transfers outside the EU are covered by Standard Contractual Clauses).
• Privacy Safeguards: Telemetry events strictly exclude private customer identities (no customer names, emails, phones, or private street addresses are ever sent to analytics servers).

These tools measure the performance of our promotional campaigns and enable personalized food discounts.

• Marketing Pixels (Meta Pixel _fbp, TikTok Pixel _ttp, Snapchat Pixel _scid): Browser pixels and server conversion APIs are used only with marketing consent. Server conversions may share SHA-256 hashed email/phone, IP address, user agent, advertising cookie/click identifiers, order value and a pseudonymous order reference. Hashing does not anonymize these identifiers. Strictly blocked unless explicit marketing consent is granted in the cookie banner. When consented, they track conversion attribution (e.g. order completed) with hashed contact details; advertising identifiers and device information remain personal data.