Cookie policy

A cookie is a small text file a website asks your browser to keep, so the site can recognise your browser on a later visit. A website can also keep information in your browser's local storage or session storage, which work in a similar way but stay on your device. In this policy, cookies means all three. Each item below is named by the key it is stored under, so you can find it in your browser's settings.

These keep the store working, so they are always on. pm_cookie_consent records the cookie choice you make and is kept for 12 months. pm_store_access and pm_store_refresh keep you signed in until you sign out or your session expires, and pm_device_id identifies this browser so we can protect your account. pm_store_pending_verification_email remembers the email address you are verifying while you finish signing up. pm_checkout_attempt lets you return to a payment you have already started. Your cart is not kept in your browser: it is held on our servers against your session.

These remember choices you make, so the site stays the way you left it: pm_locale keeps your language, pm_market your shopping region and pm_theme your light or dark mode; pm.deliveryArea and pm.deliverySlot keep the delivery area and time you picked; and pm_anc_*, pm_modal_* and pm_app_banner_dismissed remember the notices, pop-ups and app banner you closed. Each one is written only when you make that choice yourself, and holds nothing but that choice. Your Preferences setting is recorded with your cookie choice.

With Analytics switched on, we use Google Analytics 4 (GA4), provided by Google, to understand how our public pages are used and improve the store. It loads only after you allow Analytics and sends no information to Google before that choice. It measures visits to public shopping, information and policy pages, including the home page, collection, brand and product pages, search, specials pages and promotions. For each visit we send the public page address, a general page title and a limited referring address. The address keeps only the advertising campaign tags a link may carry (its source, medium and campaign); the rest of the link's query and its fragment are removed. On product lists we also send the filters and sort order you chose, such as a category, brand or page number. We send the search terms you enter, but a term that looks like an email address, phone number, order or customer number or web address is never sent: we only note that a term was removed. We also send which products a list showed and which one you opened, the product pages you view, the products you add to your cart, and which promotions and banners were shown and which one you opened. It never reports sign-in, account, verification, unsubscribe, cart, checkout, order or gift card confirmation pages, and we never send your name, email address, phone number, address, account ID, order numbers or payment details. Google also receives random browser and session identifiers and browser and device information, and uses your IP address to derive an approximate location; Google says GA4 does not log or store IP addresses. We do not enable advertising personalisation through this integration. Google may process the information outside Australia, including in the United States, under its privacy policy at https://policies.google.com/privacy. The first-party _ga cookie distinguishes browsers, and _ga_* cookies maintain session information, for up to two years from your last visit, subject to your browser's limits. When you switch Analytics off in Cookie settings, we stop further analytics collection and delete these cookies from this website. This does not delete information already sent to Google.

With Marketing switched on, we use Meta Pixel, a tool from Meta Platforms, Inc., to measure our ads on Facebook and Instagram and to show you offers there that suit you. It loads only after you switch Marketing on, and it reports only from public shopping and information pages, such as the home page, collection and product pages, search, specials and promotions, and from your cart, checkout and the order and gift card confirmation pages. It never reports from sign-in, account, verification or unsubscribe pages, or from our policy pages. From those pages it sends Meta the page's address, the products you view and add to your cart, and the value and products of a completed order, with details of your browser and device and your IP address. For a completed order or gift card, our own server also sends Meta the same purchase through Meta's Conversions API, with your browser's details and the _fbp and _fbc cookies, so the purchase still counts when your browser blocks the Pixel; Meta matches the two copies by order number and counts it once. Meta may process this information outside Australia, including in the United States, under its own privacy policy. The Pixel keeps _fbp, which identifies this browser to Meta, and _fbc, which records the Facebook or Instagram ad you arrived from, each for 90 days; Meta may also use its own cookies, such as fr, which it sets on facebook.com. pm_meta_purchases, in session storage, notes the orders this tab has already reported, so none is counted twice, and is cleared when you close the tab. When you switch Marketing off, neither the Pixel nor our server sends Meta anything more, and we delete _fbp and _fbc.

Select Cookie settings at the bottom of any page to see your current choice and change it. Your choice lasts for 12 months, and we also ask again whenever we publish a new version of this policy. You can block or delete cookies in your browser's settings too, but without essential cookies you will not be able to sign in or check out.

We update this policy whenever we change the cookies or storage we use, and the date at the top shows when it last changed. When a change affects the choice you made, we ask for it again on your next visit.