Cookie policy
Last updated: October 4, 2026
About this policy
This policy lists everything Andalu stores in your browser, what each item is for and how long it lasts. We run no advertising cookies and no cross-site trackers. One category is optional, and it is off until you turn it on.
What are cookies?
Cookies are small files a site stores in your browser. Browser storage keeps data on your device in the same way, and the page reads it directly. Andalu uses both, for three things:
- • Security: Telling a buyer from an attack at checkout, and limiting repeated payment attempts
- • Your settings: Your cart, your region, platform and currency, and your cookie choice
- • Counting demand: Which products get viewed and added to carts, only if you allow it
What we store, and for how long
Essential
Always EnabledThese run whatever you choose, because checkout cannot be kept safe without them. They carry no advertising and no profile of you.
Examples:
- Device security ID (andalu_did), 1 year
- Your country and region (andalu_ip_country, andalu_ip_region), 1 day
- Bot check on checkout, donations and our forms (Cloudflare Turnstile)
- Text-code verification on the phone step (Google Firebase and reCAPTCHA), which keeps this device verified for 7 days
- Your cart, settings and cookie choice, stored in your browser
- Only if you sign in: your account session (andalu_session, 30 days, readable only by our server)
- Only if you sign in: the first letter of your email for the menu (andalu_account, 30 days)
- Only if you sign in: a random ID that tells us when you sign in on a new device (andalu_adev, 400 days)
- We keep your email, name, country and phone on this device to fill checkout next time, for up to 180 days after your last checkout. "Not you?" at checkout clears it
Analytics
In the EU, the UK, Switzerland, Iceland, Liechtenstein and Norway, and wherever we cannot tell where you are, it is off until you allow it. Google Tag Manager loads for every visitor, but it starts locked and sets no analytics cookies until you say yes. Everywhere else it is on by default, unless your browser sends Global Privacy Control, and you can turn it off at any time. When it is on, Google Analytics counts visits and purchases, and Microsoft Clarity records how pages are used. We also count which products get viewed and added to carts.
Examples:
- Google Analytics cookies (_ga and _ga_ followed by an ID)
- When you buy, the purchase itself: the order reference, the products and the amount, never your name, email or payment details
- Microsoft Clarity cookies (_clck, _clsk) and anonymized session replays and heatmaps, only after you allow analytics. Checkout, order and account pages are masked, so what is on them is not recorded. Clarity also reads a Microsoft identifier cookie (MUID) from c.bing.com to link visits. We run no Microsoft ads with it
- PostHog cookie (ph_ followed by an ID and _posthog), an anonymous ID with no name, email or phone number behind it, only after you allow analytics
- Our own count: the product, the kind of event (viewed or added to cart) and the day, with no IP address, device ID, name or email address
Cookie preferences
Your cart, your settings and the checks that keep checkout safe. These cannot be turned off here.
Lets Google Tag Manager set analytics cookies and starts Microsoft Clarity, plus our own count of products viewed and added to carts. Off until you turn it on in the EU, the UK and Switzerland; on by default elsewhere, unless your browser sends Global Privacy Control. Payment pages are never recorded.
Third parties
These run the parts of the service we don't run ourselves, and each may store something in your browser to do it:
| Provider | Purpose | Policy |
|---|---|---|
| Stripe | Essential. Takes your payment on its own page at stripe.com and checks it for fraud. Your card details go to Stripe, never to us. | View |
| Cloudflare Turnstile | Essential. An automated security check on checkout, donations and our forms that tells people from bots. It runs in the background and rarely asks for a click. | View |
| Google Firebase and reCAPTCHA | Essential. Sends the text code that confirms your mobile number when you buy, and checks the request is not automated. It keeps this device verified for 7 days, so you are not asked every time. | View |
| Cloudflare | Essential. Serves and protects the site. Cloudflare may set a security cookie to tell visitors from attacks. | View |
| Sentry | Error monitoring, for every visitor. When a page fails, a technical error report goes to Sentry (ingest.sentry.io), with a count of page loads so an error rate can be read. It sets no cookie and stores nothing on your device. It never receives your name, email address, payment details or a page address beyond its path. Hosted in the United States. | View |
| Google Tag Manager | Loads for every visitor. It holds our analytics tags. In the EU, UK and Switzerland it starts locked and sets no analytics cookies until you allow analytics. Elsewhere analytics is on by default, unless your browser sends Global Privacy Control. Loading it sends your IP address and browser type to Google, as any script loaded from Google does. | View |
| Google Analytics | Only after you allow analytics: counts visits, the pages and products viewed and what was added to carts. Sets the cookies _ga and _ga_ followed by an ID. When you buy, we report the purchase to it once the payment is taken: the order reference, the products and the amount. Never your name, email or payment details. Its advertising features are off. | View |
| Microsoft Clarity | Where analytics is on (after you allow it in the EU, UK and Switzerland; by default elsewhere): records how pages are used. That includes clicks, scrolling, anonymized session replays and heatmaps. Sets the cookies _clck and _clsk. It masks what visitors type, and it masks the whole of the checkout, order and account pages, so what is on them is not recorded. | View |
| PostHog | Only after you allow analytics: counts which pages and checkout steps are used, and what is added to carts and bought. For a purchase, that is the order reference, the products and the amount. Uses an anonymous ID in the cookie ph_ followed by an ID and _posthog. Page addresses are sent without their query, it records no sessions, and it never receives your name, email address, phone number or payment details. Hosted in the United States. | View |
| Cloudflare Web Analytics | Only after you allow analytics: counts page views and load times without cookies. A deferred script from static.cloudflareinsights.com sends the page address, the page you came from, load timings and your browser type. It stores nothing on your device. | View |
Managing cookies
Browser settings
Most browsers allow you to control cookies through their settings. You can choose to reject all cookies or receive notifications before they are set. Visit your browser's help menu for instructions.
Cookie preferences tool
Use the Cookie preferences section above to manage optional cookies. You can change your preferences at any time.
Changing your mind
Your choice is saved in your browser, so it applies on this device. Come back to this page at any time to change it, or use Cookie settings in the footer.
Questions and answers
What are cookies?
Cookies are small files a site stores in your browser and reads on your next request. Browser storage works the same way, but the page reads it directly instead of sending it with every request. This policy covers both.
Do you use advertising cookies?
No. Andalu runs no ad pixels and no cross-site advertising trackers, so there is no marketing category to turn off. Our order emails do carry a tracking image and tracked links, only so we can confirm your order reached you. That is not a cookie, and nothing about it is used for marketing. Google Tag Manager is the one tag manager we use. The tags inside it are Google Analytics, with its advertising features off, and Microsoft Clarity. Both measure how the site is used and show no ads.
Why does Google Tag Manager load before I choose?
It is the switchboard for our analytics tags. In the EU, the UK and Switzerland it loads in a locked state. Every storage permission starts denied, and the tags inside it wait for your yes. Elsewhere analytics storage starts granted, unless your browser sends Global Privacy Control. Loading it does send Google your IP address and browser type, as any script loaded from Google does. If you would rather it did not load at all, block googletagmanager.com in your browser: nothing on the site depends on it.
Can I turn off the essential ones?
Not on this page. Your browser can block them, but then checkout will not work. The bot check, the text code and the attempt limits are what keep stolen cards off Andalu.
What happens if I say no to analytics?
Nothing about your order changes. Turn analytics off from the notice, the footer's Cookie settings link or this page, and Microsoft Clarity stops and its cookies are deleted. Google Tag Manager then sets no analytics cookies, and your purchase is not reported to Google Analytics. Your browser also stops sending us the product view and add-to-cart counts, so the site ranks products without them.
How long does each one last?
The device security ID lasts 1 year, your country and region 1 day, and a verified phone stays verified for 7 days. If you sign in, your session lasts 30 days from your last visit. Your cart and settings stay until you clear your browser. Our Privacy Policy lists how long each record is kept.
How do I remove them?
Clear cookies and site data for andalu.com in your browser settings. That also clears your cart, your settings and your cookie choice, so this page will ask again.
Questions about cookies?
If you have questions about this Cookie Policy or our use of cookies, ask us through the contact form.