02
Categories
- Strictly necessary. Required to run the Service: keeping you signed in, holding your cart, remembering your cookie choice, and protecting payments from fraud. These cannot be switched off.
- Analytics. Our own first-party analytics and Google Analytics 4, which tell us which files get read, for how long, and where visitors come from. Set only if you allow them.
- Ads & marketing. Remembering ad-platform click ids (for example from TikTok, Meta or Google) so we know which campaigns brought you here. We do not currently load any advertising pixels. Set only if you allow them.
03
Cookies We Set
This is the complete list of cookies the Service sets on your device:
| Cookie | Provider | Category | Purpose | Expires |
|---|---|---|---|---|
| vu_consent | ViralUFOs | Necessary | Stores your cookie choice so we don't ask again. | 12 months |
| vu_cart | ViralUFOs | Necessary | Guest cart token so your Field Gear cart survives a reload. | 30 days |
| better-auth.session_token | ViralUFOs | Necessary | Keeps you signed in to your account. On HTTPS the name carries a __Secure- prefix. | 7 days, renewed while you use the site |
| __stripe_mid | Stripe | Necessary | Fraud prevention for card payments. Set only on checkout pages, when Stripe loads. | 12 months |
| __stripe_sid | Stripe | Necessary | Fraud prevention for the current checkout session. Set only on checkout pages. | 30 minutes |
| vu_vid | ViralUFOs | Analytics | Random first-party visitor id for our own analytics. Set only with your consent. | 13 months |
| vu_attr | ViralUFOs | Analytics / Ads | First-touch campaign source: UTM parameters, ad click ids, referrer and landing page. Set only with analytics or ads consent, and only when you arrive from a campaign link. | 90 days |
| _ga | Analytics | Google Analytics 4 client id. Set only with your consent. | 2 years | |
| _ga_<ID> | Analytics | Google Analytics 4 session state. Set only with your consent. | 2 years |
Nothing in the analytics or ads categories is written until you choose “Accept all” or switch that category on in Preferences. If you later switch analytics off, we delete vu_vid and the Google Analytics cookies straight away.
05
Local Storage
We also keep a few small flags in your browser’s local and session storage, for example to avoid counting the same purchase twice or re-sending your campaign source after you sign in. These hold no personal details and follow the same consent rules as the cookies above.
06
Third Parties
- Google Analytics 4. We use Google Consent Mode v2. The Google tag starts with every storage setting denied. We send it no events, and it sets no cookies, until you allow analytics. The ads category controls Google’s
ad_storage,ad_user_dataandad_personalizationsignals; they stay denied unless you switch ads on. - Stripe. Stripe.js loads only on checkout pages and sets its fraud-prevention cookies there. Card details go straight to Stripe and never touch our servers.
- Cloudflare Turnstile. Our spam check loads only when you start using a protected form (newsletter, sign-in, registration, bug report).
- YouTube. Embedded videos show a thumbnail image served by YouTube. The player itself loads only when you press play, from the privacy-enhanced youtube-nocookie.com domain.
We do not load advertising pixels from TikTok, Meta or any other ad network. These providers handle data under their own privacy policies.
07
Changing Your Choice
Use the Cookie settings link in the footer of any page to review or change your choice at any time. Most browsers also let you view, block, and delete cookies in their settings; blocking strictly necessary cookies may stop parts of the Service (such as signing in) from working.
08
Changes
We may update this Cookie Policy as our practices evolve. Material changes will be reflected here with a new “Last updated” date, and when the cookie categories change we will ask for your choice again. See also our Privacy Policy.