This policy explains the cookies and similar technologies we use on bottles.pt, what each one does, and how you can control them. It sits alongside our Privacy Policy, which covers personal data more broadly.
We’ve kept this short and concrete. Every item in the tables below is something actually running on the site - there’s no advertising or third-party tracking hidden in there.
1. What are cookies, exactly?
A cookie is a small text file that a website asks your browser to store on your device. The next time you visit, your browser sends it back, so the site can recognise you, remember your preferences, or keep you signed in.
We also use a couple of similar technologies that work in the same spirit:
- localStorage - a small storage area inside your browser, used for things like your language and theme preferences.
- Session storage - same idea, but cleared as soon as you close the tab.
For simplicity, we refer to all of these as “cookies” in the rest of this policy.
2. The categories we use
- Strictly necessary - these make the site work: signing you in, keeping your session valid, preventing fraud, processing payments, and remembering that you’ve answered the cookie banner. You can’t opt out of these because without them the site simply doesn’t function.
- Functional - these remember preferences you’ve chosen, like light or dark mode. They make the experience nicer but the site still works without them.
- Analytics - help us understand how people use Bottles in aggregate: Google Analytics 4 (visits, pages, funnel steps) and Grafana Faro (errors and page-speed measurements). They only run after you accept this category in the cookie banner; if you refuse, GA4 stays cookieless and Faro keeps no session.
- Marketing / advertising - we don’t use any. There is no advertising, no remarketing, and no third-party tracking on Bottles.
3. The cookies we set
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
bottles_session | HTTP cookie | Holds your JWT so you stay signed in during a session | Session | Strictly necessary |
bottles_refresh | HTTP cookie | Refresh token used to renew your session safely | 30 days | Strictly necessary |
bottles_csrf | HTTP cookie | Protects forms from cross-site request forgery (CSRF) attacks | Session | Strictly necessary |
bottles_locale | localStorage | Remembers your chosen language | Persistent | Strictly necessary |
bottles_theme | localStorage | Remembers light or dark mode | Persistent | Functional |
bottles_consent | localStorage | Remembers your cookie banner choice so we don’t ask again | 12 months | Strictly necessary |
bottles_age_ok | HTTP cookie | Remembers you confirmed you are 18 or older, so the age check appears once per visit | Session | Strictly necessary |
bottles_ticker_dismissed | HTTP cookie | Remembers you closed the 'Ending soon' strip for this browser session. | Session | Functional |
bottles_attrib | HTTP cookie | Remembers which link or campaign brought you to Bottles during this visit, so a later sign-up can be attributed to it. No personal data. | Session | Functional |
_ga | HTTP cookie (Google) | Google Analytics 4: distinguishes visitors and sessions so we can count visits, pages and the steps from viewing a lot to bidding, in aggregate. Loaded only after you accept analytics cookies; without consent it sends anonymous, cookieless pings only. | 2 years | Analytics |
_ga_* | HTTP cookie (Google) | Google Analytics 4: keeps the session state for our web property. | 2 years | Analytics |
com.grafana.faro.session | sessionStorage | Grafana Faro: an anonymous per-visit id that groups the errors and page-speed measurements of one visit, so we can fix what breaks. Never persists across visits; disabled entirely when you refuse analytics. | Session | Analytics |
bottles_app_promo | HTTP cookie | Remembers you saw or dismissed the mobile app suggestion, so it doesn’t reappear this visit | Session | Functional |
__stripe_mid | HTTP cookie (Stripe) | Fraud prevention during payment | 1 year | Strictly necessary |
__stripe_sid | HTTP cookie (Stripe) | Fraud prevention during a checkout session | Session | Strictly necessary |
cf_clearance | HTTP cookie (Cloudflare) | Confirms you passed the Turnstile bot check during signup or password recovery | Session | Strictly necessary |
| Firebase auth state | localStorage | Keeps you signed in if you used Apple or Google sign-in | Persistent | Strictly necessary |
4. Third-party cookies
- Stripe sets
__stripe_midand__stripe_sidwhen you reach a payment screen. They’re used to detect fraudulent payment activity. See stripe.com/cookie-settings. - Cloudflare sets
cf_clearancewhen you complete the Turnstile bot check on signup or password recovery. See cloudflare.com/cookie-policy. - Firebase / Google stores authentication state in your browser’s localStorage if you sign in with Apple or Google. See policies.google.com/technologies/cookies.
These providers act on our behalf for the specific purposes above. None of them use the data they collect through bottles.pt to show you advertising.
5. Managing your consent
You can change your cookie choices at any time on bottles.pt by clicking the button below.
Your preferences are saved in bottles_consent for 12 months.
6. Browser-level controls
You can also manage cookies directly in your browser - block them, delete them, or get warned before they’re set. Note that blocking strictly necessary cookies will break things like signing in and checkout.
7. No advertising or profiling
We want to be straightforward about this: Bottles does not use advertising cookies, remarketing pixels, or third-party profiling tools. We don’t share your browsing with ad networks, and we don’t build behavioural profiles for targeting. If that ever changes, we’ll ask for your consent first and update this policy clearly.
8. Changes to this policy
We update this Cookie Policy whenever we add or remove cookies. The “Last updated” date at the top will always reflect the most recent change.
9. Questions
If anything here is unclear, or you’d like more detail about a particular cookie, write to us at info@bottles.pt - a real person will reply.