Customer information
Cookie Notice
This Cookie Notice explains how Ceylon Cobbler uses cookies and similar browser storage on theceyloncobbler.com. Necessary technology keeps the shop secure and functional. Optional analytics and advertising technology remains off unless you choose it, and you can revisit your choice through Cookie Settings in the footer.
Last updated 2026-10-14T19:19:45.897ZWhat cookies and similar technologies are
Cookies are small values stored by a browser and returned to a website. We also use local browser storage for your privacy preference, requested shopping features and, after optional tracking is permitted, a minimal purchase-report deduplication marker. Some cookies are first-party, set for our domain, while optional providers may set their own identifiers. Storage can be session-based or remain until its expiry or deletion. A browser-only purchase marker contains an order reference and time, not a browsing history; it currently remains until site data is cleared and cannot itself enable measurement without consent. Browser storage and Google's reporting retention are different.
Strictly necessary storage
Necessary storage supports secure customer and administrator sessions, guest carts, checkout continuity, order-access handoff, request protection, rate limiting and recording your privacy choice. The cc_security_id cookie is an HttpOnly random security-only identifier retained for 30 days so visitors receive independent rate-limit allowances alongside a coarse network abuse backstop. Our compact consent record contains its version, category choices, decision time and any measurement objection, not a visitor or session ID. It lasts up to one year; refreshing the page does not renew its decision time. Necessary storage is not used for advertising. Declining optional measurement does not disable necessary hosting and security processing, which is not reused as an analytics fallback. Blocking necessary storage in your browser can prevent the requested shop functions from working.
Analytics
If Google Analytics 4 is enabled by us and you accept analytics, it may measure public page views, scroll engagement when you reach approximately 90% of a public page, search events without the words you type, product views, cart actions, checkout steps and confirmed purchases. Ecommerce events may include product identifiers/names, quantities, prices, discount codes and a non-secret order reference for deduplication. Scroll measurement uses Google's native Enhanced Measurement; automatic search, form, outbound-link, video and download measurement are disabled. Account, sign-in, administrator and private order/payment pages are excluded. Page URLs in GA4 events exclude query strings and fragments; the event's page-referrer value is blank and its page title is generic. Google may use _ga cookies to distinguish browsers and sessions and process network/device information and approximate location; these reports are not anonymous. We do not send account User-IDs, first-order eligibility hashes, contact details, form contents or access credentials to GA4. Declining analytics means no analytics requests, no cookieless pings and no aggregate-counter fallback. Unknown or expired choices do not load analytics. Rejecting analytics does not prevent shopping, checkout or payment; backend records remain authoritative for purchases.
Advertising
If enabled by us and accepted by you, Meta Pixel and TikTok Pixel may measure visits and commerce events and set provider identifiers such as _fbp or _ttp. Valid campaign click identifiers may also be retained. For an order placed with advertising consent, a confirmed purchase may be sent to Meta Conversions API or TikTok Events API using the same provider-specific event identifier as the browser event so duplicate reports can be removed. We do not manufacture attribution identifiers, create a browser fingerprint, enable automatic customer matching, or send advertising purchase events when the order does not record advertising consent.
Your controls
Accept all enables both optional categories only where the relevant provider is configured and enabled by us. Reject non-essential keeps analytics and advertising off. Manage preferences lets you choose either category separately. Stop all measurement objects to both optional categories, even if an older preference allowed them. Reopen Cookie Settings from the footer to withdraw consent at any time. Withdrawal stops future optional provider calls in this browser and removes known optional first-party cookies where possible; it cannot retract a request already sent or automatically erase provider-held data. Contact us for a data-rights request. We do not queue pre-consent events for later transmission or send account User-IDs or first-order eligibility hashes to GA4. Analytics consent does not enable advertising, and advertising consent does not activate Google's advertising features in our GA4 configuration.
Google cookies and analytics retention
Google's standard _ga and _ga_ cookies distinguish browsers and maintain session state. Their normal default lifetime is up to two years and may refresh during consented use; browser restrictions or provider settings can shorten it. That cookie lifetime is not our privacy-choice duration and not the GA4 reporting-retention period. Before GA4 collection is activated, the Google property is configured for two-month user and event retention with reset on new activity off. Most standard aggregated reports are not covered by that control, and Google's eligible deletion runs follow its own schedule. GA4 data is held by Google, not in a separate custom event or anonymous-counter database in our shop.
Providers and browser controls
Optional providers control their cookies under their own notices, and details can change. Google may process consented analytics outside Sri Lanka, including in the United States and other countries. See how Google uses information from sites or apps using its services at https://policies.google.com/technologies/partner-sites and the Privacy Policy for recipients, international processing, rights and retention. Our consent setting controls whether optional scripts load through this website; it does not make their processing anonymous. You can also delete or block cookies in your browser. Browser-level settings do not grant consent here, and an expired or unknown choice never enables optional tracking.
Changes and contact
We may update this Notice when technology, providers, purposes, or law changes. The current version and update date appear on this page. Questions about cookies or personal data may be submitted through the Contact page or sent to [email protected]. Further information about our data handling and your rights is available in the Privacy Policy.