Legal
Cookie Policy
Last updated: October 23, 2026
The short version. This site keeps your cart and your age confirmation in your own browser, and sets one first-party cookie so your visit stays consistent between pages. We use Google Analytics and Klaviyo to measure how the site is used and to improve email for people who opt in — neither is configured as an advertising or remarketing network. A cookie bar lets you Accept or Reject analytics; visitors from the EEA, UK, and Switzerland are asked before analytics loads, and a Global Privacy Control or Do Not Track signal turns analytics off automatically. There are no advertising, remarketing, or cross-site advertising technologies here, and we do not sell or share what we collect. The complete inventory is below.
What cookies and similar technologies are
A cookie is a small text file that a website asks your browser to store and send back on later visits. Related technologies do similar jobs: localStorage keeps data in your browser until you clear it, and pixels or tags are small pieces of code that report activity back to a server. This policy covers all of them, and forms part of our Privacy Policy.
First-party means set by us, on our domain. Third-party means set by another company. We use the categories below:
- Strictly necessary — required for the site to function, such as keeping your cart and honoring the age gate. These cannot be switched off without breaking the site, and we do not need your consent to use them.
- Functional — remember preferences to improve your experience.
- Analytics — help us understand aggregate traffic and performance, and improve opted-in email. We use Google Analytics 4 and Klaviyo for this; see the inventory below.
- Advertising and targeting — we do not use any. There is no ad pixel, no remarketing tag, and no cross-site tracking on this site.
Complete inventory
This is every cookie and browser storage key associated with this site. We keep it current as part of our development process rather than as an annual review.
| Name | Type | Category | Set by | Purpose | Lasts |
|---|---|---|---|---|---|
| empti:cart-v3 | localStorage | Strictly necessary | Empti (first party) | Holds the contents of your shopping cart — the products, variants, and quantities you selected — so your cart survives page loads and return visits. Stored only in your browser; it is not sent to us until you begin checkout. | Until you clear your cart or clear site data |
| empti-cart-count | sessionStorage | Strictly necessary | Empti (first party) | Stores the number of items in your cart so the header cart badge renders immediately, before the full cart loads. Session-scoped and cleared when you close the tab. | Until you close the browser tab |
| empti:tax-exemption-v1 | localStorage | Functional | Empti (first party) | Retains a sales-tax exemption application you started at checkout, including the resale or exemption certificate number you entered, so you do not have to re-enter it. Stored only in your browser. | Until you reset the application or clear site data |
| empti:recent-searches | localStorage | Functional | Empti (first party) | Remembers your recent search terms so they can be offered as shortcuts the next time you search. Stored only in your browser and never sent to us. | Until you clear site data |
| empti-announcement-dismissed | sessionStorage | Functional | Empti (first party) | Records that you closed the announcement banner at the top of the page so it stays closed. Session-scoped and cleared when you close the tab. | Until you close the browser tab |
| empti-age-verified | localStorage | Strictly necessary | Empti (first party) | Records that you confirmed you are 21 or older so the age confirmation screen is not shown on every page. Stores only a version flag — no date of birth, name, or identifier. | Until you clear site data |
| empti:cookie-consent-v1 | localStorage | Strictly necessary | Empti (first party) | Stores your analytics cookie preference (accepted or rejected) so we do not ask again on every visit and so Google Analytics and Klaviyo onsite scripts load only when your choice allows it. Contains no advertising identifier and is not used to track you across other websites. | Until you clear site data or change the preference |
| session | Cookie | Strictly necessary | Empti (first party) | A signed, HTTP-only cookie our storefront platform uses to keep your visit consistent across page requests — for example, to carry a form result through a redirect. It holds no cart contents, no account, and no advertising identifier, and it is not used to track you across other websites. | Until you close the browser or clear site data |
| _ga | Cookie | Analytics | Google LLC, set as a first-party cookie on empti.com | Assigns your browser a random identifier so Google Analytics can count you as one returning visitor rather than a new one on each visit, and report how people move through the site in aggregate. It holds no name, email address, or advertising identifier. We have turned off Google Signals and ad personalization, so this data is not used to build an advertising profile or to follow you to other websites. The cookie is set only when analytics is allowed under your preference and regional rules. | 2 years from your most recent visit |
| _ga_5M7MKER1CC | Cookie | Analytics | Google LLC, set as a first-party cookie on empti.com | Keeps the state of your current Google Analytics session — when it started and how many pages you have viewed — so a single visit is not counted as several. Because it is set on empti.com rather than on one subdomain, continuing to checkout is recorded as the same visit instead of a new one. Set only when analytics is allowed. | 2 years from your most recent visit |
| __kla_id | Cookie | Analytics | Klaviyo, Inc., set as a first-party cookie on empti.com | Lets Klaviyo recognize a returning browser for onsite analytics (pages and products viewed, cart activity) and for email personalization when you are already a known subscriber. It is not an advertising identifier and is not used to follow you across unrelated websites. Set only when analytics is allowed under your preference and regional rules. Separately, if you subscribe to Empti email, Klaviyo stores that subscription on our account so we can send the messages you opted into. | 2 years from your most recent visit (typical Klaviyo default) |
| Sentry error reporting | None | Functional | Functional Software, Inc. (Sentry) | When a page fails to load or a feature breaks, diagnostic details about the failure — the error message, the page path, and your browser and device type — are sent to our error monitoring provider so we can find and fix the fault. It sets no cookie and stores nothing in your browser. It does not record your screen, your keystrokes, or anything you type into a form, and this browser-side reporting is not loaded at all when your browser sends a Global Privacy Control or Do Not Track signal. Failures occurring on our own servers are reported separately and describe the failing request rather than the visitor. | No browser storage; reports are deleted after 30 days |
| Shopify checkout cookies | Cookie | Strictly necessary | Shopify Inc. | When you proceed to checkout you are handed off to Shopify, which sets its own cookies on its own domain to maintain your checkout session and process payment. These are governed by Shopify’s privacy policy, not ours. | Set and controlled by Shopify |
Apart from the analytics cookies listed above, we use no advertising, remarketing, social media, session recording, heat mapping, or fingerprinting technology. If we add anything to this list, we will update this page and the "Last updated" date before it goes live, and we will adjust the consent controls where the law requires it.
A note on analytics
We use Google Analytics 4 to understand which pages and products people look at, how they reach us, and where the buying process breaks down. It records page views, searches, cart activity, checkout starts, and form submissions — as counts and patterns, not as a dossier on you. We do not send it your name, email address, or anything you type into a form, and we do not use it for session recording, heat mapping, or fingerprinting. Google Signals and ad personalization are forced off in our code.
We use Klaviyo for email you subscribe to and for related onsite measurement (pages and products viewed, cart activity) so those messages stay relevant. Onsite it may set a first-party __kla_id cookie. It is not used as a cross-site advertising network. Marketing email still requires a separate subscription opt-in.
Deliberate choices enforced in our code:
- No advertising use of GA4. Google Signals and ad personalization stay off so measurement does not feed cross-context behavioral advertising.
- Analytics loads only when allowed. Visitors from the European Economic Area, the United Kingdom, and Switzerland are asked to Accept before Google Analytics or Klaviyo onsite scripts load. Elsewhere, analytics may load until you Reject it. In every region, a Global Privacy Control or Do Not Track signal prevents those scripts from loading at all, and no analytics cookie is set.
- GA4's identifier is not joined to your order record. It is a random browser id. Klaviyo may associate onsite activity with an email profile when you are already a known subscriber or identifiable through a campaign link — that is how browse and cart emails work, and only for people who opted into email.
Our hosting provider also keeps standard server logs of requests, described in our Privacy Policy. If we add another analytics or measurement product, this page and the "Last updated" date will change before it goes live.
Checkout is handled by Shopify
When you proceed to checkout you are handed off to Shopify, which sets its own cookies on its own domain to maintain your session and process payment. We do not control those cookies and cannot switch them off; without them, checkout cannot work. Shopify's own cookie and privacy policies govern them.
How to control cookies
After you confirm you are old enough to use the site, a compact cookie bar offers Accept or Reject for analytics. You can change that choice later with the Cookie preferences control in the site footer. Your choice is stored in your browser under empti:cookie-consent-v1 so we do not ask on every visit.
Visitors whose connection appears to come from the European Economic Area, the United Kingdom, or Switzerland are asked before analytics loads. Visitors from other regions may see analytics load until they Reject it; Rejecting then prevents further analytics on later visits. We use approximate location from our hosting network for that regional split — not a precise GPS location.
Every major browser lets you view, block, and delete cookies and clear site data:
- Chrome — Settings → Privacy and security → Third-party cookies, and Settings → Privacy and security → Delete browsing data
- Safari — Settings → Privacy, and Safari → Clear History
- Firefox — Settings → Privacy & Security → Cookies and Site Data
- Edge — Settings → Cookies and site permissions
You can also use your browser's private or incognito mode, which discards cookies and local storage when you close the window.
What breaks if you block them. Clearing or blocking localStorage empties your cart, brings back the age confirmation screen on your next visit, and forgets your analytics preference, because those are kept there rather than on our servers. Blocking the session cookie can cause a form result or notice to be lost when a page redirects. Blocking the analytics cookies changes nothing about how the site works for you — it only removes you from our aggregate counts. None of this is harmful, and all of it resolves once you allow the storage again.
Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control signal, or has Do Not Track enabled, we do not load Google Analytics and no analytics cookie is set — the check runs before the analytics code is requested, not after. We also record that preference so the cookie bar does not need to ask. Everything else on the site continues to work normally. We run no cross-site tracking and do not sell or share personal information, so there is nothing further for these signals to switch off.
Changes and contact
We will update this policy when our use of cookies or similar technologies changes, and we will revise the "Last updated" date at the top of the page. For questions about this policy or about anything in the inventory, email support@empti.com or use our contact form.