Every cookie, why we set it, and who receives the data.
A plain-English reference for the cookies and similar technologies used on surrealcomfort.co.uk. You can change your choices any time from the cookie preferences panel — nothing except strictly necessary cookies runs until you consent.
Strictly necessary
Always onRequired to keep the site working: signing in, remembering your basket, checkout security, saving your cookie choices, and fraud prevention. These cannot be switched off.
Legal basisLegitimate interest (essential to deliver the service you requested).
Cookies set
| Name | Purpose | Duration | Provider | Type |
|---|---|---|---|---|
| sc:consent | Stores your cookie preferences so we don't ask again. | 12 months | surrealcomfort.co.uk | First-party |
| sc:visitor | Anonymous identifier used only to keep A/B test assignments and referral codes stable across pages. | 12 months | surrealcomfort.co.uk | First-party |
| sc:utm | Remembers which campaign brought you to the site so referral credit is attributed correctly at checkout. | 90 days | surrealcomfort.co.uk | First-party |
| sb-*-auth-token | Keeps you signed in to your account. | Session / 30 days if you tick 'remember me' | Lovable Cloud (Supabase Auth) | First-party |
| __stripe_mid, __stripe_sid | Set by Stripe during checkout to detect fraud and complete card payments. | __stripe_sid: 30 min · __stripe_mid: 12 months | Stripe | Third-party |
Vendors receiving data
Authentication, database, and subscription management.
Email, hashed password, session tokens, order history.
Card payments and subscription billing.
Payment method, billing address, IP address, device signals (for fraud prevention).
Analytics
Off by defaultHelps us understand which pages help and which don't — pageviews, quiz completion, checkout drop-off. We use aggregated data to improve the box and the site.
Legal basisYour consent (opt-in, UK GDPR / PECR).
Cookies set
| Name | Purpose | Duration | Provider | Type |
|---|---|---|---|---|
| _ga, _ga_* | Distinguishes visitors and sessions for Google Analytics 4. | 13 months | Google (via GTM) | Third-party |
| _gid | Distinguishes users for 24-hour engagement measurement. | 24 hours | Third-party | |
| ph_* | PostHog product analytics — session identifier and feature-flag assignments. | 12 months | PostHog EU | Third-party |
Vendors receiving data
Site analytics, funnel measurement, Consent Mode v2 signals.
Truncated IP, page URL, referrer, device/browser, event parameters (e.g. tier viewed, quiz step).
Product analytics, event capture, experiment exposure tracking.
Anonymous distinct ID, page URL, custom events, device/browser. Hosted in the EU.
Marketing
Off by defaultMeasures the performance of our ads on Meta, TikTok and CaaSie, and lets those platforms show you relevant messaging. You can switch this off any time and it won't affect the box you receive.
Legal basisYour consent (opt-in, UK GDPR / PECR).
Cookies set
| Name | Purpose | Duration | Provider | Type |
|---|---|---|---|---|
| _fbp | Meta Pixel — attributes ad clicks to on-site actions. | 90 days | Meta | Third-party |
| fr | Meta ad delivery and measurement (set on facebook.com). | 90 days | Meta | Third-party |
| _ttp | TikTok Pixel — attributes TikTok ad clicks to purchases. | 13 months | TikTok | Third-party |
| _gcl_au | Google Ads conversion linker — attributes ad clicks. | 90 days | Third-party | |
| caasie_id | CaaSie ad platform attribution for our /caasie landing page traffic. | 30 days | CaaSie | Third-party |
Vendors receiving data
Ad measurement and retargeting via Pixel and Conversions API.
Hashed email (server-side, CAPI), event name, event value, page URL, IP.
Ad measurement and retargeting.
Event name, event value, page URL, IP, TikTok cookie ID.
Conversion measurement for paid search / display.
Ad click ID, conversion event, page URL.
Community-and-audience media buys directed at our /caasie landing page.
Campaign click ID, landing page URL, conversion event.
This page is maintained by Surreal Comfort to answer common questions about the cookies we use. Third-party vendors may occasionally change cookie names or durations; we review this reference regularly. For data-subject requests (access, deletion, portability), see privacy & legal.