Cookies
What the browser stores
After the page loads we create a session id in localStorage so the cart can be fetched. The cart count on the first paint is zero so the HTML matches before that id exists. Consent choice and a one-time exit-email flag also live in browser storage.
The admin token, if you use /admin, stays in sessionStorage on that browser and is sent as Authorization Bearer. It is not a cookie.
Events and pixels
The shop session can record a product view, an add to cart, checkout, a purchase, and whether you took a bundle, an add-on, the mug offer, or the smaller offer. That is described in the privacy policy.
Marketing pixels for Meta, TikTok, and GA4 stay blocked until you accept, and they stay unloaded when the corresponding environment id is empty. Essential only is the opt-out.