01Our approach, up front
We set cookies only where the site can’t work without them. Here is the whole list, and you can check it against your own browser.
- Three cookies, all strictly necessary. They keep you signed in and protect the login form.
- No analytics. We don’t run Google Analytics or any equivalent.
- No advertising or social media trackers. No pixels, no remarketing tags.
- No third party sets a cookie through this site.
Because we only use cookies that are strictly necessary to deliver a service you asked for, there’s no consent banner to click through. Nothing optional is being set in the background.
02What cookies and local storage are
A cookie is a small text file a site asks your browser to store and send back on the next request. It’s how a website knows that two page loads came from the same person.
Local storage is a related browser feature. It also keeps data on your device, but unlike a cookie it’s never sent to our servers automatically. We use it for your cart, which is why your basket is still there when you come back tomorrow.
Both are listed below, whichever technology puts them on your device.
03The cookies we set
All three are first-party, set by this site, and strictly necessary. The site cannot keep you logged in without them.
| Cookie | What it does | Type | Lasts |
|---|
next-auth.session-token | Keeps you signed in as you move between pages. Without it you'd have to log in on every screen. | Strictly necessary | 30 days |
|---|
next-auth.csrf-token | Protects the sign-in and sign-out forms against cross-site request forgery. | Strictly necessary | Session (deleted when you close the browser) |
|---|
next-auth.callback-url | Remembers which page to return you to after you sign in. | Strictly necessary | Session |
|---|
Over a secure connection your browser will show these with a __Secure- or __Host- prefix. That’s the same cookie with extra protection applied, not an additional one. The session cookie is HTTP-only, so scripts running on the page can’t read it.
04What we keep in your browser
These live on your device only. Your cart is never sent to us until you place an order, so we don’t know what you’ve been browsing.
| Key | What it holds | Lasts |
|---|
cart-storage | Your appetizers and menu items, so your cart survives a refresh or a closed tab. | Until you clear it, or clear your browser storage |
|---|
curry-plate-cart-storage | Curry plates you're part-way through building, including your choices on each plate. | Until you clear it, or clear your browser storage |
|---|
auth-storage | Your name, email and role, so the header can greet you without waiting on the server. It never holds your password. | Until you log out |
|---|
05Third-party cookies
None, at the time of writing. We don’t embed advertising networks, social widgets, chat tools or analytics scripts. Fonts and imagery are served as part of the site itself. If we ever add a third-party service that sets a cookie, we’ll list it here and add a consent step before it loads.
06Managing cookies and storage
You’re in control of all of it:
- Log out to clear your session cookie and the account details held in your browser.
- Empty your cart to clear the cart storage.
- Use your browser’s settings to view, block and delete cookies and site data per site, usually under Privacy and Security. A private or incognito window discards everything on close.
One trade-off: blocking cookies for this site means you can’t stay signed in, so you won’t be able to reach checkout or your order history. Blocking local storage means your cart empties every time you navigate away.
07Do Not Track and Global Privacy Control
Browsers can send a “Do Not Track” or Global Privacy Control signal asking sites not to track you across the web. There’s no cross-site tracking here to switch off, so these signals change nothing about how this site behaves. You already have the outcome they’re asking for.
