Cookie Policy
Every cookie this site sets, what it does and how long it lasts. Four are necessary; two are optional.
Draft for review. This document was prepared as part of the CravePlatter site build and has not been reviewed by counsel. Confirm the entity details, retention periods, insurance limits and governing-law clauses with your lawyer, and the food-safety claims with your local health department, before launch.
This page lists every cookie and similar technology craveplatter.com sets, what each one does and how long it lasts. It is a companion to the Privacy Policy.
1. Your choices
Strictly necessary cookies are set as soon as you arrive, because the site does not work without them. Nothing else is set until you accept it in the banner. You can change your mind at any time from the “Cookie settings” link in the footer, and you can clear everything from your browser’s own settings. Declining analytics does not degrade the site — the builder, ordering and delivery tracking all work identically.
2. Strictly necessary
| Name | Purpose | Duration |
|---|---|---|
cp_session |
Keeps your basket and your place in an order across page loads. | Session |
cp_builder_draft |
Remembers the platter you were configuring so a refresh does not lose it. Stored on your device; never sent to us until you submit. | 7 days |
cp_consent |
Records which cookie categories you accepted, so we stop asking. | 6 months |
cp_csrf |
Protects forms against cross-site request forgery. | Session |
3. Analytics — only with consent
| Name | Purpose | Duration |
|---|---|---|
cp_visit |
Counts a visit once, so we can tell whether a page is working. | 24 hours |
cp_attrib |
Records which page an order started from, at the level of the page, not the person. | 30 days |
Analytics are aggregated. We look at whether people finish the builder, not at what any one person ordered.
4. Third parties
Our payment processor sets its own cookies inside its hosted payment frame, at the moment you pay, for fraud prevention. Those are governed by the processor’s own notice. We embed no advertising pixels, no social trackers and no session-replay tooling, and we do not run retargeting.
5. What we deliberately do not do
The typefaces on this site are self-hosted rather than loaded from Google Fonts, so no font request leaves for a third-party CDN carrying your IP address. Photography is served from our own domain for the same reason.
6. Do Not Track and Global Privacy Control
We honour the Global Privacy Control signal: if your browser sends it, analytics cookies are not set and the banner does not ask. We do not sell or share personal information in any case.