Legal
Cookies
Seven cookies, all strictly necessary. No analytics cookies, no advertising, no tracking.
What we set
This is the complete list. It is written from the code that sets each cookie, and it is reviewed whenever that code changes. Nothing else is stored in your browser: we use no local storage, no session storage and no third-party scripts of any kind.
| Name | What it does | Lifetime | Category | Who gets it |
|---|---|---|---|---|
| np_age_ok | Records, for our server, that you confirmed you are of legal age to buy nicotine products where you live. Without it every page shows the age overlay and checkout is refused. | 30 days | Strictly necessary (legal obligation) | Every visitor who confirms the age question |
| np_age_ui | The same fact, readable by your browser, so a page served from our edge cache can remove the age overlay before it is painted instead of asking again. It is not what the server trusts. | 30 days | Strictly necessary | Every visitor who confirms the age question |
| np_cart | An opaque random token that links your browser to your basket. It holds no personal data; the basket itself is a row in our database. | 30 days | Strictly necessary | Visitors who add a product to the basket |
| pe_checkout_draft | What you have typed on the checkout form (name, address, options), so a refresh or a step back does not empty it. | 30 minutes | Strictly necessary | Visitors who start filling in the checkout |
| np_order_view | Set after you place an order or look one up with its number and email, so the order page can show it to you without the reference in the address bar. | 2 hours | Strictly necessary | Customers viewing their own order |
| np_ref | Set only when you arrive through a creator's link. Holds the creator code so the discount you followed the link for can be applied at checkout. Nothing about you is stored in it. | 30 days | Strictly necessary for the discount; not tracking | Visitors arriving via a creator link |
| sb-…-auth-token | The sign-in session for our staff (admin) and for approved creators. A shopper never receives one: buying needs no account. | 7 days | Strictly necessary (authentication) | Staff and creators who sign in |
Why there is no cookie banner
Consent is required for cookies that are not strictly necessary for a service you asked for — analytics, advertising, social-media embeds. This site has none of those. Every cookie above exists to do something you started: confirm your age, hold your basket, remember your checkout form, show you your own order, apply a code from a link you followed, or keep a staff member signed in. Our content-security policy only allows scripts from this site itself, so a third-party tag cannot load even by accident.
Visit statistics without cookies
To know which pages people find us through, we count visits on our own server, without a cookie and without storing anything in your browser. A visit is grouped for one day only, by a code our server computes from a secret that changes every day together with your IP address and browser type; the IP address and browser type themselves are never stored, and the code cannot be linked to you or to another day. What we keep is only the page you landed on, the website that sent you (its name, not the full address), the device type (phone, tablet or computer) and whether the visit added something to the basket or ordered. The figures are only ever read in aggregate. No third party receives them.
If we ever add a non-essential script, it will not run until you have agreed to it, the choice will be as easy to refuse as to accept, and you will be able to change it from a link in the footer. This page will be updated first.
How to remove them
Every browser lets you delete cookies for a single site from its privacy settings. Deleting ours signs you out of nothing you are signed into as a shopper; you will simply be asked the age question again and your basket will start empty.
How the data behind these cookies is used is set out in the privacy policy.