What we store, and who receives it.

1. What is stored on your device

Only the first item exists before you choose; the others appear only for the purpose you accept.

• kcounter.consent — set by us, kept for 182 days. It records only your two answers (improve the site, measure our ads) and when you gave them. It is what stops us asking again, and it is stored whichever way you answer.
• ph_<project key>_posthog — set by PostHog, in a cookie and in local storage, kept for about a year. A random identifier for your browser and your current visit. Only after you accept "Improve the site", and deleted from your browser when you withdraw it.
• _fbp — set by Meta, roughly 90 days. A random browser identifier. Only after you accept "Measure our ads".
• _fbc — set by Meta, roughly 90 days. Records the ad click that brought you here, taken from the fbclid in the link. Only after you accept "Measure our ads".

2. Improving the site: PostHog

After you accept "Improve the site", PostHog's script loads from its EU servers. It records how our pages are used so we can see where the shop is confusing: pages opened, taps and clicks, scrolling, and a replay of the page as it appeared on your screen. Everything you type into a field is hidden before it leaves your browser. Recording stops when you go to payment — that page is run by Stripe on its own site and cannot be recorded. We never attach your name or email to any of it.

• Steps we count: product viewed, added to basket, checkout started, sent to payment or checkout failed, came back from payment without paying, order paid — with the product, basket value, number of items and page language.
• Recipient: PostHog Inc., acting for us as a processor under a data processing agreement, with the data hosted in the EU (Frankfurt).
• Kept: session recordings for about 30 days, counted steps for about one year.
• If you reject this purpose, or never answer, PostHog's script is never added to the page.

3. What your browser sends to Meta

After you accept "Measure our ads", Meta's script loads and reports these events. Before that, the script is never added to the page at all — it is not loaded-then-silenced, it is simply absent.

• PageView — each page you open.
• ViewContent — when you open a product page, with that product's identifier and price.
• AddToCart — when you add something, with the product identifier, price and quantity.
• InitiateCheckout — when you press Checkout, with the identifiers of the products in your basket, the number of items, the basket value and the currency.
• Purchase — on the order confirmation page, with the order value and currency.

4. What our server sends to Meta when you order

If you accepted "Measure our ads" and then complete an order, our server sends Meta one further Purchase event directly. This is the part a cookie banner usually does not mention, so it is set out in full. Your name, email, phone and address are hashed with SHA-256 before sending — that is pseudonymisation, not anonymisation, and Meta can still match it to an account. Four values are sent unhashed because hashing them would break matching silently.

• Hashed before sending: email, phone number, first name, last name, city, region, postal code, country.
• Sent unhashed: your IP address, your browser's user-agent string, and the _fbp and _fbc values above.
• Order details: total value, currency, and the identifier of each product bought.
• If you rejected, or never answered, this event is not sent — the order still completes normally.

5. Who receives the Meta data

Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, Ireland, with onward transfer to Meta Platforms Inc. in the United States. Meta does not only report back to us: it also uses this data for its own advertising purposes, including improving how ads are targeted. For this collection and transmission we and Meta act as joint controllers.

6. Changing your mind

You can withdraw consent at any time, for either purpose, and it is as easy as giving it. Use the link below, or the cookie link in the footer of any page. Withdrawing "Improve the site" stops recording at once and deletes PostHog's identifier from your browser. Withdrawing "Measure our ads" stops all future Meta events, with one honest limitation: if Meta's script has already loaded during the current visit, it is fully removed on your next page load rather than instantly, and any _fbp or _fbc already placed on your device stay until they expire or you clear your browser's cookies.

Questions

Write to hello@kcounter.com with any question about this notice or about the data held on you, and you will get a direct answer.

Cookie choices