Cookie and Device Storage Policy

Essential operation

The store uses a session cookie named hth_session to keep your bag, sign-in and form security working. Ordinary sessions time out after two hours of inactivity. The browser normally removes the session cookie when its session ends, although browser session-restore behavior varies.

Remembered devices

If you check Remember me, hth_remember keeps a random device credential for up to 30 days. The server stores a hash rather than the credential itself. Signing out revokes the saved login for that device. Password changes and disabled access invalidate saved authentication. Leaving the box unchecked does not create a remembered login.

Security and notice preferences

Cloudflare Turnstile loads on selected protected forms and processes browser/network signals for bot prevention. See the provider details below. The site also stores hth_cookie_notice in this browser’s local storage for up to 180 days to remember dismissal of this notice. This is a convenience preference, not consent to tracking.

No optional tracking in the current store

This application does not install advertising or analytics trackers. The notice’s dismissal does not turn on tracking. You can revisit this explanation using Cookie information in the footer. External payment apps/sites may use their own storage after you open them.

Your controls

You can delete or block cookies and local storage in browser settings; doing so may sign you out or prevent your bag and forms from working. Global Privacy Control and Do Not Track leave our no-advertising/no-sale practices in place. We will add appropriate choices before introducing optional tracking technologies.

Cloudflare and payment-provider technologies

Turnstile processes IP address, TLS fingerprint, browser/user-agent information and site key/origin signals. Security tokens and browser checks support bot detection; any Cloudflare challenge or clearance storage depends on its configuration. We do not treat notice dismissal as consent to optional tracking or describe all Cloudflare services as cookie-free. Read the Turnstile Privacy Addendum and Cloudflare Privacy Policy. Blocking the security script may prevent protected submissions; contact us for help.

Opening hosted Stripe or Square checkout, Cash App, Venmo or an external TotilPay page puts you in that provider’s service, where its own cookies, device storage and privacy choices may apply. The Heart-T-Hogs cookie notice does not control those services or make their independent storage practices identical to ours. See Privacy Policy for links. The store does not embed those providers’ advertising trackers merely by listing their payment options.