What we store on your device, and why.
This page lists every cookie and every piece of browser storage this site uses, who sets it, what it does and how long it lasts. If you would rather just change your choices, you can do that here too.
Last updated 27 September 2026
The short version
We use the cookies we need to make the site work. Those are always on, because without them the basket empties, sign-in stops working and the contact form cannot tell you from a bot.
Optional cookies and browser storage are off until you allow them. PostHog collects cookieless page-view and web-performance statistics while you decide and continues in that limited mode if you reject Analytics; session recording, interaction autocapture, error tracking and product events stay off unless you allow them. Google Tag Manager starts with storage and advertising permissions denied so it can receive your consent state and may send limited cookieless measurements; Google analytics cookies, advertising cookies and personalised advertising remain disabled until you grant the matching permission.
Some of what we store is not technically a cookie. A cookie travels to the server with every request; local and session storage stay in your browser and never leave it. The rules that protect you treat both the same way, so both are listed here.
Strictly necessary
Needed for the site to work: keeping your basket, remembering dismissed messages, keeping you signed in, and the anti-spam check that protects the contact form.
Your control: Always on. These cannot be turned off, because the site cannot do its job without them. They are not used to track you and they are not shared with anyone.
| Name | Set by | Stored as | What it does | How long it lasts |
|---|---|---|---|---|
| vf-consent-v1 | VibeMagic | Local storage | Remembers the cookie choices you made, so we stop asking on every page. | Until you clear it in your browser |
| vf-cart-v1 | VibeMagic | Local storage | Keeps the items in your basket as you move between pages, and when you come back later. | Until you empty the basket or clear it in your browser |
| vf-announce-dismissed-v1 | VibeMagic | Session storage | Remembers that you closed the announcement bar at the top of the page. | Until you close the tab |
| vf.oauth.session | VibeMagic | Local storage | Keeps you signed in to the VibeMagic Portal, so you are not asked for your password on every page. | Until you sign out |
| vf.oauth.pkce | VibeMagic | Session storage | Holds the one-time secret that proves a sign-in was started by you and not by someone else. | Deleted the moment sign-in finishes |
| vf.oauth.returnUrl | VibeMagic | Session storage | Remembers the page you were on, so we can send you back there after you sign in. | Deleted the moment sign-in finishes |
| vf.oauth.fingerprint | VibeMagic | Local storage | A random id for this browser, so the sign-in service can recognise a device you have used before. | Until you clear it in your browser |
| __cf_bm | Cloudflare | Cookie | Tells automated traffic apart from real visitors, which is what keeps the site up under attack. | 30 minutes |
| cf_clearance | Cloudflare | Cookie | Records that you passed a security check, so you are not challenged again on every page. | Up to 1 year, and only set if you were challenged |
| cf_chl_* (Turnstile) | Cloudflare | Cookie | Runs the anti-spam check on the contact form. It stands in for a CAPTCHA, so you are not asked to identify traffic lights. | Until you close the browser |
-
vf-consent-v1
- Set by
- VibeMagic
- Stored as
- Local storage
- What it does
- Remembers the cookie choices you made, so we stop asking on every page.
- How long it lasts
- Until you clear it in your browser
-
vf-cart-v1
- Set by
- VibeMagic
- Stored as
- Local storage
- What it does
- Keeps the items in your basket as you move between pages, and when you come back later.
- How long it lasts
- Until you empty the basket or clear it in your browser
-
vf-announce-dismissed-v1
- Set by
- VibeMagic
- Stored as
- Session storage
- What it does
- Remembers that you closed the announcement bar at the top of the page.
- How long it lasts
- Until you close the tab
-
vf.oauth.session
- Set by
- VibeMagic
- Stored as
- Local storage
- What it does
- Keeps you signed in to the VibeMagic Portal, so you are not asked for your password on every page.
- How long it lasts
- Until you sign out
-
vf.oauth.pkce
- Set by
- VibeMagic
- Stored as
- Session storage
- What it does
- Holds the one-time secret that proves a sign-in was started by you and not by someone else.
- How long it lasts
- Deleted the moment sign-in finishes
-
vf.oauth.returnUrl
- Set by
- VibeMagic
- Stored as
- Session storage
- What it does
- Remembers the page you were on, so we can send you back there after you sign in.
- How long it lasts
- Deleted the moment sign-in finishes
-
vf.oauth.fingerprint
- Set by
- VibeMagic
- Stored as
- Local storage
- What it does
- A random id for this browser, so the sign-in service can recognise a device you have used before.
- How long it lasts
- Until you clear it in your browser
-
__cf_bm
- Set by
- Cloudflare
- Stored as
- Cookie
- What it does
- Tells automated traffic apart from real visitors, which is what keeps the site up under attack.
- How long it lasts
- 30 minutes
-
cf_clearance
- Set by
- Cloudflare
- Stored as
- Cookie
- What it does
- Records that you passed a security check, so you are not challenged again on every page.
- How long it lasts
- Up to 1 year, and only set if you were challenged
-
cf_chl_* (Turnstile)
- Set by
- Cloudflare
- Stored as
- Cookie
- What it does
- Runs the anti-spam check on the contact form. It stands in for a CAPTCHA, so you are not asked to identify traffic lights.
- How long it lasts
- Until you close the browser
Analytics
Helps us see which pages are useful and where people get stuck, so we can improve the site.
Your control: Off until you allow it. Turn it on or off whenever you like, using the button at the bottom of this page.
| Name | Set by | Stored as | What it does | How long it lasts |
|---|---|---|---|---|
| _ga | Google Analytics | Cookie | Tells one visitor apart from another, so a returning reader is not counted twice. | 2 years |
| _ga_* | Google Analytics | Cookie | Keeps track of the current visit: which pages you saw, and in what order. | 2 years |
| ph_*_posthog | PostHog | Local storage | Uses a random browser id to record page views, clicks, browser errors and a masked playback of your visit, so we can see which parts of the site work and where people get stuck. Form entries are masked and URL query strings are removed. | 1 year |
-
_ga
- Set by
- Google Analytics
- Stored as
- Cookie
- What it does
- Tells one visitor apart from another, so a returning reader is not counted twice.
- How long it lasts
- 2 years
-
_ga_*
- Set by
- Google Analytics
- Stored as
- Cookie
- What it does
- Keeps track of the current visit: which pages you saw, and in what order.
- How long it lasts
- 2 years
-
ph_*_posthog
- Set by
- PostHog
- Stored as
- Local storage
- What it does
- Uses a random browser id to record page views, clicks, browser errors and a masked playback of your visit, so we can see which parts of the site work and where people get stuck. Form entries are masked and URL query strings are removed.
- How long it lasts
- 1 year
PostHog collects only cookieless page-view and web-performance statistics while you decide and after rejection. It creates an irreversible identifier using a salt that changes daily, strips the IP address before storing the event, and deletes the salt after processing that day’s events. The identifier cannot be reversed to recover the IP address or used to recognise the same visitor on another day. After you allow Analytics, PostHog can use browser storage, interaction autocapture, error tracking and masked session recording. We do not connect its identifier to your name or account, and PostHog is configured not to create person profiles. Google starts in denied Consent Mode and may send limited cookieless measurements before you make a choice, but cannot use analytics storage until you allow it.
Marketing
Lets us measure whether our campaigns reach the right people.
Your control: Off until you allow it. Turn it on or off whenever you like, using the button at the bottom of this page.
| Name | Set by | Stored as | What it does | How long it lasts |
|---|---|---|---|---|
| _gcl_au | Cookie | Records that you arrived from one of our adverts, so we can tell which ones lead to real enquiries. | 90 days | |
| IDE | Google (doubleclick.net) | Cookie | Measures how our adverts perform, and stops you being shown the same one over and over. | Up to 13 months |
| test_cookie | Google (doubleclick.net) | Cookie | Checks whether your browser accepts cookies at all. | 15 minutes |
-
_gcl_au
- Set by
- Stored as
- Cookie
- What it does
- Records that you arrived from one of our adverts, so we can tell which ones lead to real enquiries.
- How long it lasts
- 90 days
-
IDE
- Set by
- Google (doubleclick.net)
- Stored as
- Cookie
- What it does
- Measures how our adverts perform, and stops you being shown the same one over and over.
- How long it lasts
- Up to 13 months
-
test_cookie
- Set by
- Google (doubleclick.net)
- Stored as
- Cookie
- What it does
- Checks whether your browser accepts cookies at all.
- How long it lasts
- 15 minutes
Turning marketing off hides nothing from you. It only stops us measuring which advert brought you here.
Videos load only when you press play
Some pages show videos hosted on YouTube. We do not load the YouTube player with the page. What you see first is a still image served from our own site, and the player is fetched only once you click it. Until then YouTube receives nothing and sets nothing.
When you do press play, we use the youtube-nocookie.com address, which is the reduced-tracking version of the embed. Google may still set cookies at that point, under their privacy policy rather than ours.
Changing your mind
You can change your choices at any time. Nothing on this site is withheld from you for declining the optional cookies.
- Use the button below, or the Cookie preferences link in the footer of every page.
- Every browser also lets you block or delete cookies through its own settings, usually under Privacy. Doing that clears our record of your choice, so we will ask you again on your next visit.
- Blocking the strictly necessary items will break parts of the site: the basket will empty between pages, and sign-in will not hold.
When this page changes
We update this page whenever the cookies we use change. The date at the top tells you when that last happened.
If we add a new purpose, we ask everyone again rather than assuming an old answer still stands.
Questions
If anything here is unclear, or you want to know what we hold about you, get in touch and a person will answer.
This page covers what we store on your device. Our Privacy Policy is the companion document: it covers the personal information we hold, why we hold it, how long we keep it, and the rights you have over it.