Legal / Cookies
Cookies
Everything this site puts in your browser, why it is there, and how long it stays. It is a short page, and that is the point.
The short version
We set two cookies of our own and both are needed to run the shop. We count visits ourselves as well — on our own server, with no cookie of its own and no script in your browser — and that count never leaves us. Separately, we use Google Analytics, loaded through Google Tag Manager, and it runs only if you agree: before you answer, and for as long as you say no, there is no Google code in the page at all — not loaded-but-disabled, absent. What there is none of either way: advertising or remarketing pixels, and nothing here is wired to an ad platform. When we tell Google what you agreed to, we refuse advertising storage and advertising personalisation on your behalf, because we do not run advertising and never asked you about it.
The list below is not a description of how we think the site behaves. It is what a browser was actually sent, measured page by page against the live site, including the payment page and the page that shows you your eSIM.
What we set
fivebars-session — your session
This holds a random identifier and nothing else. Everything it points at — what’s in your basket, whether you’re signed in — is stored on our server, not in your browser. Your browser will not let any page read it back out, and it is sent only over an encrypted connection.
XSRF-TOKEN — the form guard
A one-purpose token that lets our server tell your form submissions apart from a request another website tried to make on your behalf. It is a security control and it contains nothing about you.
Those two last 2 hours from your last visit to a page, and then they are gone. Neither identifies you between visits. The choice cookie below is the exception and the only one on this site that outlives a visit — it exists to remember your answer, including a refusal, which we would otherwise have to ask about again on every page.
fb_consent — your cookie choice
Written when you answer the analytics question, and only then. Your browser’s own cookie list will show you its contents in plain text — unlike our other two it is deliberately not encrypted, so what this page says about it can be checked rather than believed. It holds three things: which version of this page you were shown, a random reference with no meaning outside our records, and yes or no. Scripts on the page cannot read it. It lasts 12 months, after which we ask again.
On every page except the payment page, that is the whole list — measured, not assumed — plus whatever Google sets if you agreed to Google Analytics, which is described further down. What you bought and the email you gave us live in your order record, described on our privacy notice, not in your browser.
On the payment page
The checkout page contacts somebody other than us whatever you have chosen, and it is the only page that does so without asking. The card fields are supplied directly by Stripe, our payment processor, so your card number reaches them and never us. Stripe sets its own cookies and browser storage there, to keep your payment attempt together and to spot card fraud. None of that is analytics and none of it is switched off by refusing analytics — it is the machinery that takes the payment.
Two of those are written under our domain name rather than Stripe’s, so your browser lists them next to ours. They are still Stripe’s: we cannot read them, we did not choose them, and one of them is long-lived — around a year — because recognising a returning card-testing bot is the job it does.
Stripe also loads hCaptcha, a bot-detection service, to protect the payment form from automated card testing. It sets its own state in your browser too. We did not choose to add it, and we have not found a way to switch it off while still taking cards — we have not worked through every configuration of Stripe’s card fields looking for one, so treat that as our conclusion rather than a measurement. Either way it is there, so we are telling you instead of leaving you to find it.
On some visits — not all — Stripe additionally loads HUMAN Security, a second bot-detection service; in your browser’s own list of connections it appears as px-cloud.net, a hostname left over from its PerimeterX days. Which visits get it is Stripe’s decision, taken inside their code. We have not found a way to switch it off while still taking cards — we did not work through every configuration of Stripe’s card fields looking for one, so that is our conclusion rather than a measurement.
We are not listing what that one stores, and the reason is the same one that makes the rest of this page worth reading: it did not appear in any of the loads we measured, so we have never seen its storage ourselves. We would rather leave a gap here than fill it from somebody’s documentation. If it runs on your visit, your browser’s own cookie list for that page is the accurate answer.
Stripe’s fraud tooling carries more than one service of this kind and chooses between them, so we will not tell you this list can never grow. What we can tell you is how a new one would reach you: it would first turn red the check we run against this page, and it would be named here in the same change that lets the request through.
What reaches them is your IP address and basic information about your browser. None of it is used to advertise to you, and we ask none of them anything about you. No other page on this site loads any of it — which is measured on every other page, not assumed.
We describe what these do rather than list their cookie names and lifetimes, because those are theirs to change and we would rather leave a gap here than publish a table that quietly stops being true. Your browser will show you the full list on that page, and each of these companies publishes a privacy policy of its own.
Their own privacy policies, if you want them: Stripe, hCaptcha and HUMAN Security. Those open on the companies’ own sites. We check that all three addresses still answer as part of the routine checks we run against this site, because a dead link on a privacy page is a promise that quietly stopped being kept.
Google Analytics, and only if you agree
We use Google Analytics 4, loaded through Google Tag Manager (container GTM-WPPWRQS4). Apart from the payment page, it is the only thing on this site that runs anybody else’s code in your browser.
It is not loaded until you say yes. Before you answer, and for as long as you say no, the container’s address is not in the page we send you — so there is nothing for your browser to fetch and nothing for a blocker to block. You can check that yourself without any tools: open the page source on any page and search for “googletagmanager”. If you have not agreed, it is not there.
If you do agree, Google receives your IP address, the pages you open, roughly when and for how long, and basic information about your device and browser. Google processes that for us as a measurement service; the property it goes to is G-C7ZLDWV9DC.
We also pass Google your answer in its own consent signal, and we refuse two things on your behalf that you were never asked about: advertising storage and advertising personalisation. We do not run advertising here, so there is no answer that could switch them on.
Beyond page views, Google measures what it calls enhanced measurement: scrolling, clicks on links that leave the site, interactions with forms, video plays and file downloads. We switched one part of it off — site search — because it records what you type into our own search box, and we publish elsewhere on this page that we do not keep search terms. Switching it off is what makes that true rather than merely intended.
One consequence is worth spelling out, because it lands on the page that takes your money: form-interaction measurement applies to the payment page as well. What Google is told is that a field was interacted with, never what was in it — but it does mean that, once you have agreed, the payment page has one more recipient of data than the ones described above it.
Every data-sharing option Google offers is switched off in our account: nothing is shared with other Google products and services, nothing is contributed to Google’s models or business benchmarks, and neither Google’s technical support nor its account specialists have access. One consequence of that is honest to state rather than sell: with modelling off, Google gives us no estimate of the visitors who refused, so the numbers we see there simply do not contain them.
Measured on this site with analytics agreed to, not copied from Google’s documentation: _ga (400 days), _ga_C7ZLDWV9DC (400 days). Both are written under our domain name, so your browser lists them next to ours, and both are readable by any script on the page — unlike the two of ours above, which your browser will not hand to JavaScript at all.
That lifetime is measured rather than quoted. Google’s own documentation describes the first of those as lasting two years; browsers cap a cookie set this way, and 400 days is what your browser was actually sent.
You can change your mind on this page at any time, and refusing stops it being loaded at all rather than merely stopping it reporting. What refusing does not do is reach into your browser and remove a cookie Google already set: those stay until they expire or you clear them, and your browser can clear them for this site right now.
What we don’t set, and won’t quietly start setting
Google Analytics is described above, it is the only measurement product here, and it does not run unless you agree. Beyond it: no advertising or remarketing pixels — no Meta, no TikTok, no Google Ads. No A/B testing tools, no session recorders, no heatmaps, no chat widget, no social share buttons that phone home. No third-party fonts: ours are served from this domain.
There is one thing sitting behind a switch, and you should know it exists. Turning on Apple Pay or Google Pay would make the payment page contact Google as well. That switch is off. If it is ever turned on, this page and the privacy page say so in the same change that turns it on — the disclosure is not allowed to arrive later than the request.
Our own count stays deliberately coarse — an arrival, where it came from, which page it landed on — because that is all we need to sell a data package, and everything past it is something we would have to protect, disclose and eventually explain. Google’s measurement is finer than ours by default, including things like how far down a page you scrolled. That is exactly why it sits behind a question instead of being on for everyone.
We do count visits, and here is exactly how
We keep our own count of the visits this site gets, where they arrived from and which page they landed on. It is built from the requests our server already answers, so it needs nothing in your browser: no analytics cookie of ours, no script of ours, no pixel. It is a different thing from Google Analytics above, it is made whether or not you agreed to that, and none of it is sent to Google.
Telling one visit apart from the next uses the session cookie listed above — the one that already has to exist for the shop to work. Nothing additional is set for counting, which is why the list on this page still has two entries on it and not three.
What a visit record holds: the name of the site or search engine that sent you, the page you arrived on, how many pages were opened, whether one of them was a plan page, and whether the visit ended in an order. What it does not hold: your IP address, any device or browser fingerprint, your name, or anything that could be matched to you somewhere else.
We count visits, not people, and we try not to blur the two. A single page opened for no measurable time looks the same whether it was a reader or an automated crawler using an ordinary browser name, so our own admin screen shows those separately rather than adding them into one “visitors” number. That changes nothing about what is stored — it is a rule about how honestly the same rows may be described.
Our count stays with us. It is a separate store from anything Google holds: it is not uploaded, not joined to it, and not exported to an advertising platform. It is also the reason we kept counting ourselves after adding Google — ours sees everybody who asks this server for a page, including the people who refuse Google and the people running a blocker, and Google only ever sees the ones who agreed and ran its code. The two are supposed to disagree, and a day when they matched would be the surprising one.
A visit record is kept for 24 months and then deleted by a scheduled job — the same window, from the same setting, as the record of how a buyer found us that is described on our privacy notice.
If you want to clear them
Your browser can delete both of our cookies at any time, and doing so costs you nothing but a signed-in session. Blocking them entirely is also your right — the shop will not work, because there is no way to carry a basket to a payment page without something identifying the basket.
Your choice
Right now: you have not answered yet, so nothing of Google’s is loaded on any page you open.
That record is kept for 24 months and then deleted by a scheduled job. The choice itself is remembered in your browser for 12 months, after which we ask again.