Cookies
What the browser stores
After the page loads we create a session id in localStorage so the cart can be fetched. The cart count on the first paint is zero so the HTML matches before that id exists. Consent choice and a one-time exit-email flag also live in browser storage.
The admin token, if you use /admin, stays in sessionStorage on that browser and is sent as Authorization Bearer. It is not a cookie.
Events and pixels
The shop session can record a product view, an add to cart, checkout, a purchase, and whether you took a bundle, an add-on, the mug offer, or the smaller offer. That is described in the privacy policy.
Analytics tags (Google Analytics 4, Microsoft Clarity) stay blocked until you choose Analytics only or Accept all. Marketing pixels (Meta, TikTok) stay blocked until you choose Accept all. Tags the shop has not set up never load. Essential only is the opt-out.