Cookie
Policy

Cookies are small text files placed on your device when you visit a website. Alongside cookies, we also use similar local storage technologies built into your browser (such as localStorage) that serve the same purpose: remembering information about your visit. This policy explains what cookies and similar technologies Maison Écho uses, why we use them, and how you can control them.

This Cookie Policy should be read alongside our Privacy Policy, which explains in more detail how we handle your personal data generally. Where this policy refers to "cookies", it also covers the local storage technologies described above unless stated otherwise. Every cookie and local storage entry described below is first-party: set directly by maisonecho.co.uk, even where the underlying service (such as Shopify or Vercel) is provided by a third party.

By continuing to browse this site after being shown our cookie banner, or by clicking "Accept Cookies", you consent to our use of non-essential cookies as described below. You can decline non-essential cookies and still use the site's core functionality in full.

Under the UK Privacy and Electronic Communications Regulations (PECR) and the equivalent EU ePrivacy rules, we only need your consent to use cookies that are not "strictly necessary" for the site to function. Strictly necessary cookies (the ones that keep you logged in, keep your basket intact, or maintain a secure session) can lawfully be set without asking first, but we still disclose them in full below for transparency.

For any cookie that isn't strictly necessary (at present, only our analytics cookie, Section 05), we ask for your consent via the banner shown on your first visit. You can withdraw that consent at any time; see Section 08.

These cookies are essential for core features of the site to work: signing in to your account, keeping items in your basket, voting once per listing on Classified, and accessing time-gated features such as the Vault or Cipher's Gambit. They are set automatically and don't appear as a choice on our cookie banner, because PECR doesn't require consent for them.

You can still block them through your own browser settings if you prefer, though doing so will likely break account login, checkout, and access to any gated page. The full list, with exact names and durations, is in the Cookie Manifest (Section 07).

These remember a direct consequence of something you've actively done on the site: muted the ambient audio, dismissed the install-app prompt, made progress in one of the site's interactive features, or told us your cookie preference in the first place. They're stored locally on your device, are never transmitted to a third party, and are never used to build an advertising profile.

Because each one only ever records the outcome of a feature you chose to use, UK ICO guidance treats this category as not requiring the same separate consent prompt as tracking or analytics cookies, but we still list every one of them, in full, in the Cookie Manifest (Section 07).

We use Vercel Web Analytics to understand overall traffic to the site, for instance, how many people visit each page. It's built to be privacy-friendly by design: it doesn't use cookies or any persistent identifier to follow you individually, across browsing sessions, or across other websites, and every figure it reports to us is aggregated.

Even though it's cookie-free by design, we still gate it behind your consent, out of caution: it only loads after you click "Accept Cookies" on the banner. Click "Decline" instead, and it never loads at all.

We do not currently use any advertising or marketing cookies, and no third-party advertising tracker, pixel, or script runs on this site.

If you subscribe to our mailing list, your email address is sent directly from our own server to Klaviyo, our email service provider, purely to add you to that list. That request happens entirely on our server: it does not run any Klaviyo script in your browser and does not set any Klaviyo cookie. How Klaviyo handles the data we share with it is described in our Privacy Policy.

If this ever changes (for example, if we introduce genuine advertising cookies in future), we will update this policy and ask for your consent before any such cookie is ever set.

cust_access_token, cust_refresh_token, cust_id_token: Set when you sign in via Shopify's secure customer login. Keeps you signed in to your account. Category: Strictly Necessary. Duration: the access token expires with your session; the refresh and ID tokens last 30 days.

cipher_clearance_token: Set once you unlock the Vault with a valid access code, so you aren't asked to re-enter it. Category: Strictly Necessary. Duration: 30 days.

cipher_game_clearance: Set when you begin the Cipher's Gambit bonus game from the Terminal, confirming you're mid-session so the game page can't be reached directly. Category: Strictly Necessary. Duration: 7 minutes.

classified_voter_id: Set the first time you vote on the Classified page, so the same browser can't vote twice on the same listing. Category: Strictly Necessary. Duration: 1 year.

cipher_bm_override_token, cipher_vault_override_token: Internal preview-access tokens used only for staged early access to time-gated pages; not set during ordinary browsing. Category: Strictly Necessary. Duration: 30 days.

cipher_cookie_consent: Stored locally the moment you respond to our cookie banner, so we remember your Accept/Decline choice and don't ask again. Category: Functional. Duration: until you clear this site's data in your browser.

cipher_shopify_cart_id: Stored locally so the items in your basket are still there if you leave and come back. Category: Functional. Duration: until you clear this site's data, or complete or abandon checkout.

cipher_audio_muted: Stored locally to remember whether you've muted the site's ambient audio. Category: Functional. Duration: until you clear this site's data.

cipher_pwa_banner_dismissed_at: Stored locally after you dismiss the "install this site as an app" prompt, so it doesn't reappear immediately. Category: Functional. Duration: 24 hours.

A further set of similarly-scoped local storage entries support the site's own interactive features specifically (the Vault entry terminal, Cipher's Gambit, and Black Market intel drops), tracking things like a timed lockout after too many failed attempts, a saved best time, or a one-time reward already claimed. None of these leave your device, are used for advertising, or are shared with any third party. Category: Functional. Duration: varies by feature, from a few minutes (lockout timers) up to indefinitely (best-time records) until you clear this site's data.

Vercel Web Analytics: sets no cookie and no persistent identifier on your device at all; see Section 05. Category: Analytics.

You can accept or decline non-essential cookies via the banner shown on your first visit. If you'd like to change your answer afterwards, click "Manage Cookie Preferences" below to reopen that same banner at any time.

Every modern browser also lets you block or delete cookies globally, or on a per-site basis, through its own settings: check your browser's help documentation for the exact steps, as these vary by browser and device. Blocking strictly necessary cookies (Section 03) will prevent parts of the site (account login, checkout, the Vault, and other gated pages) from working correctly.

Because our analytics (Section 05) don't use cookies at all, blocking cookies in your browser won't stop them if you've separately clicked "Accept" on our banner. The correct way to opt out of analytics specifically is to click "Decline" on that banner (reopen it via the button below if needed) or clear this site's data through your browser settings.

Where we process personal data via cookies (for example, an aggregated analytics figure, or your account session), the same rights described in our Privacy Policy apply, including the right to access, correct, or request deletion of that data.

For any cookie-related question, complaint, or request, contact our data controller at: support@maisonecho.co.uk. If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EU, you have the right to lodge a complaint with your own national data protection authority instead.

We may update this Cookie Policy from time to time (for example, if we add a feature that uses a new cookie). Material changes will be communicated by a notice on the site, and where the law requires it, we will ask for your consent again before any new non-essential cookie is set.

This Cookie Policy was last updated on 01 June 2026.