Cookies

1What this page is

MTBAY sets three cookies. They keep you signed in, hold your basket and remember which language you picked. None of them track you and none of them belong to anybody else — which is why this site has no cookie banner.

A cookie is a short piece of text that a site asks your browser to keep and send back on your next request. It is how a web page remembers anything at all: without one, every request would arrive as though it were your first.

All three are listed below in full — the name, who sets it, how long it lasts, what it holds and what it is for. There is no fourth. Nothing else is kept in your browser either: no local storage, no session storage, no indexed database, no fingerprint, no pixel.

2The three cookies

mtbay_session

Keeps you signed in. Seven days.Set by the server when you sign in. httpOnly, SameSite=Lax, and Secure on the live site, so no script on the page can read it and your browser never sends it over plain HTTP. It holds a signed token carrying your user id and your email address, and nothing else.

mtbay_cart

Remembers a basket you started before signing in. Seven days.Set by the server the first time you add a kit. Same flags as the session cookie. It holds one random id pointing at a basket — not the kits, not a price, nothing about you. It is deleted the moment you sign in, because from then on your basket is found by your account instead.

mtbay_locale

Remembers that you chose English or Polish. One year.Written by the language switcher, in your browser, at the moment you click it. SameSite=Lax, and readable by the page, because the page is what writes it. It holds two letters: en or pl. It is never set by guessing — until you use the switcher there is no such cookie, and your browser's own language setting is used instead without being stored.

The basket cookie is refreshed every time you add something, so a basket you are still filling does not expire underneath you. The session cookie is not refreshed: it lasts seven days from the moment you sign in, and then you sign in again.

Signing out deletes the session cookie. Signing in deletes the basket cookie. Otherwise each one goes when it reaches its date.

3Why there is no cookie banner

Because there is nothing here to ask you about.

The rule is regulation 6 of the Privacy and Electronic Communications Regulations. It says a site must get your consent before storing a cookie — and then exempts a cookie that is strictly necessary to provide a service you have explicitly requested. All three of ours sit in that exemption, so asking would be theatre: a banner over cookies that have to be set anyway for the page to do the thing you just asked it to do, and that you could not meaningfully refuse.

The session cookie is the sign-in you asked for. The basket cookie is the basket you asked for. Neither has any second purpose, and neither is read by anybody but this shop.

The language cookie deserves a sentence of its own, because a cookie filed under preferences is usually the one that does need consent. This one does not. It is written only when you click the language switcher, which makes remembering your choice the service you requested by clicking. Nothing infers it from your browser's settings, nothing writes it behind your back, and it carries nothing except the two letters you chose. A preference cookie needs consent when it is set without being asked for, or when it does something else as well. This one is neither.

If a cookie is ever added that is not strictly necessary, a consent banner arrives with it and this page is rewritten. We would rather tell you there is nothing to consent to than ask you a question with only one answer.

4What is not here

None of these cookies follow you anywhere, and there is no third-party cookie on this site, because there is no third party on this site:

1. No analytics — not Google Analytics, not a self-hosted alternative, nothing counting your visit.
2. No tag manager, and no container script that could load one later.
3. No advertising pixel, no conversion tracking and no remarketing list.
4. No embedded video, map, chat widget or social button.
5. No font loaded from somebody else's server: the font is downloaded once when the site is built and served from this shop's own domain, so opening a page tells Google nothing.
6. No fingerprinting, and no profile of you held anywhere.

A page from this shop makes requests to this shop's own domain and to nowhere else. That is checkable: open the network panel in your browser and watch.

5Turning them off

Your browser's settings can refuse or delete cookies, per site or everywhere, and that is the only place to do it — this shop has no cookie controls of its own, because it has nothing optional to offer you control over.

What breaks is predictable. Without the session cookie you cannot stay signed in, so your account page and your downloads are out of reach. Without the basket cookie your basket empties on every page load. Without the language cookie the shop reads your browser's language on each visit instead of remembering what you chose. Browsing the catalogue works perfectly well with all three blocked.

Deleting a cookie deletes nothing held about you on the server. For that — what is held, how long, and how to have it removed — see the privacy policy.

6When this page changes

If a fourth cookie is ever set, it is listed here before it ships. If it is not strictly necessary, a consent banner arrives at the same time and the section above is rewritten to say so. The date at the top of the page moves whenever either of those happens.