Cookie Policy

Cookie Policy

What We Put
On Your Device

Some cookies keep your cart working and can't be switched off. The rest measure the site and run our ads — those are yours to refuse.

Always on Strictly necessary

Cart, login, checkout, fraud checks.

Always on Functional

Region, currency, order tracking.

Optional Analytics

Which pages work, which don't. Includes session replay.

Optional Marketing

Ad measurement, audiences, email and cart reminders.

What counts as a cookie

A cookie is a small text file a site stores on your device. We also use pixels, tags, local storage and SDKs — this page calls all of them cookies, because the distinction matters to engineers and not to you.

Names and lifespans are set by the providers, not by us, and they change. The tables below cover the main ones, not every last item.

Session recording

Microsoft Clarity records how you move through the site — mouse movement, scrolling, clicks and taps, replayed to us as an anonymised session, plus heatmaps. We use it to find the button nobody can see and the checkout step where everyone gives up. It isn't watched live and it isn't tied to your name.

Text you type into forms is masked, and payment details never reach it — checkout runs on Shopify's own infrastructure. We can't see your card number and neither can Clarity.

Microsoft is a joint controller for this data. See the Microsoft Privacy Statement.

The cookies themselves

Necessary and functional — always on

Who Examples What it does / how long
Shopify cart checkout_token Holds your cart through to checkout. Up to 2 weeks.
Shopify _secure_session_id secure_customer_sig Secure session, keeps you signed in. Session to 1 year.
Shopify _tracking_consent localization Remembers your cookie choices, region and currency. 1 year.
ParcelPanel Tracking cookies Runs the order tracking page. Session to 1 year.

Analytics — optional

Who Examples What it does / how long
Shopify _shopify_y _shopify_s Store analytics — visits, sessions, traffic sources. 30 min to 1 year.
Google Analytics _ga _gid Counts visitors and pageviews, maps journeys. 24 hours to 2 years.
Microsoft Clarity _clck _clsk MUID Session replay and heatmaps, as in section 02. 1 day to 1 year.

Marketing — optional

Who Examples What it does / how long
Meta _fbp fbc The Meta Pixel — did an ad lead to a purchase, and audience building. Around 3 months.
Klaviyo __kla_id Links your email sign-up to your browsing for relevant email and cart reminders. Up to 2 years.

Meta and Google may combine what they collect here with data from other sites you visit. That is how ad networks work and it's worth knowing. Their policies govern it: Meta, Google, Klaviyo, Shopify.

Turning them off

In your browser

Every major browser can block or delete cookies, and most can block third-party cookies while leaving your cart intact. Settings → Privacy. Blocking everything will break checkout — that isn't us being awkward, it's how carts work.

At the source

  • Google Analytics — the opt-out add-on works across every site you visit.
  • Meta — your ad preferences.
  • Microsoft Clarity — Microsoft's own privacy controls.
  • Klaviyo email — the unsubscribe link works immediately and we don't make you explain yourself.

Global Privacy Control

If your browser sends a GPC signal we treat it as an opt-out of the sale or sharing of personal information wherever the law recognises it. You don't need to tell us separately.

Transfers, rights, changes

Most of these providers are US-based, so data collected through these cookies may be processed in the United States. Those transfers rely on the safeguards each provider has in place, described in the policies linked above.

Depending on where you live you can access, correct or delete the data we hold and object to certain processing. Email us — there's no form. Full detail in the Privacy Policy.

If we add a tool or drop one, this page changes and the date below updates. For anything significant we'll say so rather than hoping you don't notice.

Privacy requests
info@wildhollowco.com

Put "Privacy" in the subject line. Formal requests answered within one month, most within 1–2 business days.

Updated 23 Aug 2026