We don't set any.
No cookies, no analytics, no tracking pixels. Here is what is actually stored on your device, and why you are not being asked to click a banner.
version 1.0 — last updated 25 August 2026
This site sets no cookies at all
Not one. That is a verified property of this storefront, not a claim about intent:
- The storefront code contains zero uses of document.cookie. Nothing is written to your device before you do anything.
- No analytics, tag manager or advertising pixels. The codebase and its dependency list were searched for Google Analytics, Google Tag Manager, Plausible, PostHog, Fathom, Hotjar, Matomo, Microsoft Clarity and the Meta pixel. Zero matches.
- No session replay, no heatmaps, no error-reporting SDK — no Sentry, LogRocket or Datadog RUM.
- Fonts are self-hosted. They are downloaded at build time and served from this domain, so loading a page makes no request to Google and does not disclose your IP address to it.
Why you are not being asked to consent
Regulation 6 of PECR requires consent before storing or reading information on your device, except where that storage is strictly necessary to provide a service you have explicitly asked for.
Nothing at all is stored until you take an action — add something to your basket, or sign in. Everything that is then stored is needed to do the thing you just asked for. So the consent requirement is not engaged: there is nothing to consent to.
That does not remove the duty to tell you. Regulation 6 requires clear information about what is stored whether or not consent is needed, which is what this page is for.
Local storage, and what each item is for
Instead of cookies this site uses your browser's local storage. It never leaves your device on its own — it is not attached to requests the way a cookie is, and it is not sent to any third party.
Your basket
Holds what you have added to your order so it survives a page reload. Written as soon as you add an item; cleared when you clear your basket.
Sign-in tokens
Only if you create an account and sign in. Keeps you signed in between visits and identifies you to our server. Removed when you sign out.
Your saved profile
Only if you sign in. Your name and email, so the site can greet you and pre-fill checkout without asking the server again.
Pending order number
Written the moment you are sent to pay, so we can show you the right order when you come back from the payment page.
Staff dashboard tokens
Only on a staff device, after a member of staff signs in to the dashboard. Never set on a customer’s browser.
All of these are strictly necessary or functional. None is used for advertising, profiling or measurement.
The two that do receive data, and neither is a cookie here
Stripe — on the payment page only
Paying takes you off this site to a checkout page hosted by Stripe. Stripe sets its own fraud-prevention cookies (__stripe_mid, __stripe_sid) on its own domain, and is the controller of them. Stripe.js is not loaded anywhere on this site.
OpenStreetMap — while you type a delivery address
The address autocomplete sends what you have typed to nominatim.openstreetmap.org to fetch suggestions. It is not a cookie, but it is a request to a third party from your browser, so it belongs on this page. It only starts after four characters, and it is delayed 400ms so it is not sent on every keystroke.
Both are covered in more detail in our privacy notice.
How this page stops being true
The “no banner needed” position is easy to lose by accident. Any one of these would end it, and each is an afternoon's work away:
- Adding any analytics — Google Analytics, Tag Manager, Plausible, PostHog, Fathom, Hotjar, Matomo.
- Adding an advertising or conversion pixel — Meta, LinkedIn, Google Ads, TikTok.
- Adding session replay or heatmaps, or an A/B testing tool.
- Switching fonts, icons or scripts to a CDN loaded at runtime instead of self-hosted.
- Embedding a video or social post that loads from a third party on page load.
- Adding an error-reporting or product-analytics SDK, or a live chat widget.
- Loading Stripe.js site-wide rather than keeping payment on Stripe's own page.
- Setting any preference cookie that is not strictly necessary.
If any of those is ever added, this page changes and a consent banner appears with it — and the banner has to actually block the script until you consent. A banner that appears while the script has already loaded is worse than no banner, because it documents the breach.
Clearing what is stored
Every modern browser lets you view and clear site data from its settings. Because the only things stored here are the ones that make ordering work, clearing them will empty your basket and sign you out. Nothing else is lost — your past orders live on our server, not on your device.
Questions about this page: contact Wrap & Roll at hello@wrapandroll.com, or the people who host this site at hello@customercloud.cc.