Cookies
Last updated: 10 September 2026
The short version
Some of what this site puts on your device is needed to run the shop — keeping you signed in, showing prices, keeping a payment safe. Everything beyond that is your decision, and none of it happens until you make it.
You can change your mind whenever you like. There is a Cookie preferences link at the foot of every page, and it opens the same panel wherever you are, so changing your answer never costs you your place.
What we ask you about
Three things, and you can answer them separately rather than all at once.
- Remembering your choices. If you pick a currency yourself, saying yes lets us remember it for a year. Say no and prices still work — we simply guess from where you are each visit rather than remembering what you chose.
- Counting visits. Saying yes lets Google Analytics set a cookie, so somebody coming back is not counted as a new visitor. Say no and we still count the visit on our own server — without a cookie, without knowing who you are, and in a way that cannot follow you from one day to the next. There is more about that in our privacy notice, including how to ask us not to.
- Advertising. Whether Google may use your visit for advertising audiences and measurement. We run no adverts today, so this is off and stays off unless you turn it on.
Refusing everything is one click, in the same place and at the same size as accepting everything. Closing the banner is neither — it is not an answer, so nothing optional is stored and you will be asked again.
Everything this site can store
Set out below by the answer that governs it. This list is built from the same one the site itself reads when it decides what to store and what to remove, so it cannot quietly fall out of step with what actually happens.
Needed to run the shop (always on)
These make the site work at all — staying signed in, showing prices, and keeping a payment safe. They cannot be turned off, because without them the thing you came for stops working.
Name | Set by | Kept for | What it does |
|---|---|---|---|
mc_currency | Moon Curls | Until you close the browser | Shows prices in a currency you will recognise, guessed from the country you are in. |
sb-…-auth-token | Supabase | Until you sign out | Keeps you signed in to your own reservations and orders. |
mc_invitation | Moon Curls | A fortnight | Holds your invitation once you have followed the link, so the token is out of the address bar and not left in your history. |
mc_invitation_checkout | Moon Curls | Two hours | Carries that same invitation into the checkout you have started. |
__stripe_mid | Stripe | A year | Lets Stripe recognise this device between payments, so a card being tested by somebody who stole it looks different from you. |
__stripe_sid | Stripe | Half an hour | Guards the payment you are making right now. |
mc-consent (stored in your browser, not a cookie) | Moon Curls | Six months, then we ask again | Remembers this very answer, so you are not asked on every page. |
Remembering your choices
Keeps a currency you picked yourself, so it is still there next time. Say no and prices still work — we just guess from your address each visit rather than remembering what you chose.
Name | Set by | Kept for | What it does |
|---|---|---|---|
mc_currency | Moon Curls | A year | Remembers a currency you chose with the picker, rather than guessing from where you are. |
Counting visits
Lets Google Analytics set a cookie so somebody coming back is not counted as a new visitor. Say no and we still count the visit on our own server, without a cookie and without knowing who you are.
Name | Set by | Kept for | What it does |
|---|---|---|---|
_ga | Two years | Tells one returning visitor from another, without knowing who you are. | |
_ga_… (the rest is our Google measurement id) | Two years | The same, for this site’s own measurement. |
Advertising
Lets Google use your visit for advertising — building audiences and measuring adverts. We run no adverts today and this stays off unless you turn it on.
Name | Set by | Kept for | What it does |
|---|---|---|---|
No cookie is set today | — | Decides whether Google may use your visit for advertising audiences and measurement. We run no adverts, so nothing is set — this answer is what would govern it if that changed. |
If your browser has already told us
Some browsers and privacy extensions send a Global Privacy Control signal, which asks every site not to track you. We honour it: if your browser sends it, nothing optional is switched on and we do not put the question to you, because you have already answered it. The preference panel says so when that is what has happened.
You can still choose something different on this site, and if you do, that is what we use — a decision you made here is more specific than a setting you applied to the whole web.
About the currency one
On your first visit we work out a sensible currency from the country your request comes from, and remember it for that browsing session only. That one is necessary: without it we cannot show you a price at all.
If you choose a currency yourself using the selector in the footer, we will remember that choice for a year — but only if you have said we may. Otherwise it lasts until you close your browser.
We never use either for tracking, and neither leaves your browser except to tell our own site which price to show.
Note that the currency you are charged in follows where your order is being delivered, not the currency you were browsing in. Prices are set for each country rather than converted, so a brush costs a deliberate round amount in each market.
Paying
When you pay, Stripe sets two cookies of its own. One lasts half an hour and covers the payment you are making. The other lasts a year and lets Stripe recognise your device between payments, which is how it tells a real customer from somebody working through a list of stolen cards.
Both are treated as necessary, because they protect a payment you have chosen to make, and neither is set anywhere except the payment page. We have written down why we take that view rather than leaving it unsaid: a reasonable person could argue the year-long one should be a choice, and if we ever agree, this page will say so first.
The record we keep of your answer
Your answer lives in your own browser's storage rather than in a cookie — remembering a choice about cookies should not itself need to set one.
We also keep a record of it: which categories you agreed to, when, whether it came from the banner or the preferences panel, and a one-way hash of the address your request came from. We never store the address itself. The law puts the burden of proving consent on us, so the record is kept for three years, and a refusal is recorded just as a grant is.
The preferences panel shows you the reference for your own record. Quote it if you ever want to ask us what you agreed to.
Changing or clearing it
Use the Cookie preferences link at the foot of any page. Turning a category off takes effect straight away, and anything already stored for it is removed from your device at the same moment — telling Google to stop is only half of it.
What we cannot reach from here is a cookie set by somebody else on their own domain. For those, refusing means we tell them to stop rather than that we delete anything, and that is the honest description of what happens.
Clearing this site's data in your browser removes everything, including your answer, and you will be asked again on your next visit.
We will ask again after six months in any case, and sooner if what we store changes.
Your brush selection
What you have picked is kept in your browser's storage so it is still there when you come back. It never reaches us until you send a reservation, and clearing this site's data removes it.
Where this goes
Google is in the United States. What it receives, and on what basis it may receive it, is covered by the transfer section of our privacy notice, along with everyone else who processes anything for us.