This policy explains the cookies and similar technologies we use on bottles.pt, what each one does, and how you can control them. It sits alongside our Privacy Policy, which covers personal data more broadly.
We’ve kept this short and concrete. Every item in the tables below is something actually running on the site.
1. What are cookies, exactly?
A cookie is a small text file that a website asks your browser to store on your device. The next time you visit, your browser sends it back, so the site can recognise you, remember your preferences, or keep you signed in.
We also use a couple of similar technologies that work in the same spirit:
- localStorage - a small storage area inside your browser, used for things like your language and theme preferences.
- Session storage - same idea, but cleared as soon as you close the tab.
For simplicity, we refer to all of these as “cookies” in the rest of this policy.
2. The categories we use
- Strictly necessary - these make the site work: signing you in, keeping your session valid, preventing fraud, processing payments, and remembering that you’ve answered the cookie banner. You can’t opt out of these because without them the site simply doesn’t function.
- Functional - these remember preferences you’ve chosen, like light or dark mode. They make the experience nicer but the site still works without them.
- Analytics - help us understand how people use Bottles in aggregate: Google Analytics 4 (visits, pages, funnel steps) and Grafana Faro (errors and page-speed measurements). They only run after you accept this category in the cookie banner; if you refuse, GA4 stays cookieless and Faro keeps no session.
- Marketing / advertising - only with your consent: the Meta Pixel (Facebook and Instagram) measures which of our ads bring visits, sign-ups, bids and purchases, and lets us show lots to people who viewed them. If you refuse, the pixel does not load, its cookies are deleted and we send Meta nothing about your visits.
3. The cookies we set
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
bottles_session | HTTP cookie | Holds your JWT so you stay signed in during a session | Session | Strictly necessary |
bottles_refresh | HTTP cookie | Refresh token used to renew your session safely | 30 days | Strictly necessary |
bottles_csrf | HTTP cookie | Protects forms from cross-site request forgery (CSRF) attacks | Session | Strictly necessary |
bottles_locale | localStorage | Remembers your chosen language | Persistent | Strictly necessary |
bottles_theme | localStorage | Remembers light or dark mode | Persistent | Functional |
bottles_consent | localStorage | Remembers your cookie banner choice so we don’t ask again | 12 months | Strictly necessary |
bottles_age_ok | HTTP cookie | Remembers you confirmed you are 18 or older, so the age check appears once per visit | Session | Strictly necessary |
bottles_ticker_dismissed | HTTP cookie | Remembers you closed the 'Ending soon' strip for this browser session. | Session | Functional |
bottles_attrib | HTTP cookie | Remembers which link or campaign brought you to Bottles during this visit, so a later sign-up can be attributed to it. No personal data. | Session | Functional |
_ga | HTTP cookie (Google) | Google Analytics 4: distinguishes visitors and sessions so we can count visits, pages and the steps from viewing a lot to bidding, in aggregate. Loaded only after you accept analytics cookies; without consent it sends anonymous, cookieless pings only. | 2 years | Analytics |
_ga_* | HTTP cookie (Google) | Google Analytics 4: keeps the session state for our web property. | 2 years | Analytics |
com.grafana.faro.session | sessionStorage | Grafana Faro: an anonymous per-visit id that groups the errors and page-speed measurements of one visit, so we can fix what breaks. Never persists across visits; disabled entirely when you refuse analytics. | Session | Analytics |
_fbp | HTTP cookie (Meta) | Meta Pixel: tells your browser apart so Meta can match visits to our ads. Set only after you accept marketing cookies. | 90 days | Marketing / advertising |
_fbc | HTTP cookie (Meta) | Meta Pixel: remembers that you arrived from one of our ads (the click id in the link), so the visit is credited to that ad. Set only after you accept marketing cookies. | 90 days | Marketing / advertising |
bottles_app_promo | HTTP cookie | Remembers you saw or dismissed the mobile app suggestion, so it doesn’t reappear this visit | Session | Functional |
__stripe_mid | HTTP cookie (Stripe) | Fraud prevention during payment | 1 year | Strictly necessary |
__stripe_sid | HTTP cookie (Stripe) | Fraud prevention during a checkout session | Session | Strictly necessary |
cf_clearance | HTTP cookie (Cloudflare) | Confirms you passed the Turnstile bot check during signup or password recovery | Session | Strictly necessary |
| Firebase auth state | localStorage | Keeps you signed in if you used Apple or Google sign-in | Persistent | Strictly necessary |
4. Third-party cookies
- Stripe sets
__stripe_midand__stripe_sidwhen you reach a payment screen. They’re used to detect fraudulent payment activity. See stripe.com/cookie-settings. - Cloudflare sets
cf_clearancewhen you complete the Turnstile bot check on signup or password recovery. See cloudflare.com/cookie-policy. - Firebase / Google stores authentication state in your browser’s localStorage if you sign in with Apple or Google. See policies.google.com/technologies/cookies.
- Meta (Facebook and Instagram) sets
_fbpand_fbconly after you accept marketing cookies. With the same consent, our server also tells Meta about sign-ups, bids and purchases made after a visit, with your email and country turned into an irreversible hash first, so Meta can count them. See facebook.com/privacy/policies/cookies.
These providers act for the specific purposes above. Only Meta, and only with your marketing consent, uses this data to measure and show our ads.
5. Managing your consent
You can change your cookie choices at any time on bottles.pt by clicking the button below.
Your preferences are saved in bottles_consent for 12 months.
6. Browser-level controls
You can also manage cookies directly in your browser - block them, delete them, or get warned before they’re set. Note that blocking strictly necessary cookies will break things like signing in and checkout.
7. Advertising and measurement
Bottles advertises on Facebook and Instagram and measures those ads only with your consent. Without marketing consent the Meta Pixel does not load and our server sends Meta nothing about you. We do not sell your data, we do not share it with other ad networks, and we do not use sensitive data for targeting. You can withdraw consent at any time with the button above; the Meta cookies are then deleted.
8. Changes to this policy
We update this Cookie Policy whenever we add or remove cookies. The “Last updated” date at the top will always reflect the most recent change.
9. Questions
If anything here is unclear, or you’d like more detail about a particular cookie, write to us at info@bottles.pt - a real person will reply.