Cookie policy

The short version

We use the cookies that keep you signed in and keep the site safe, and one that credits a House Ambassador when you arrive through their link. We also count clicks on an Ambassador’s link on our server, and visits to our pages through our website host, both without a cookie. We don’t use advertising or analytics cookies, or any advertising tracker, and we don’t sell or share what the cookies hold.

Needed for the site to work

These are set only when you use the part of the site they belong to. They can’t be turned off here, because the site wouldn’t work without them.

• Sign-in cookies (their names start with sb-): set when you sign in, so you stay signed in. Scripts on the page can’t read them. They last until you sign out; one that is never used again expires after about 13 months.
• hom_cookies: remembers the choice you make about cookies, so we don’t ask again. Lasts 12 months.
• Your cart (hom-cart-v1): kept in your browser’s storage, not in a cookie. It stays until you empty it or clear your browser’s storage.
• Whether you have seen the House Ambassador code pop-up this visit (hom-code-tab-closed), so it shows once: kept in your browser’s storage until you close the tab or window.
• The Ambassador portal keeps a few of an Ambassador’s own settings in their browser’s storage, not in cookies: which announcements they’ve closed (hc-announcements-dismissed), which activity they’ve seen (hc-activity-seen, hc-activity-visit), whether they closed the install tip (hc-install-dismissed), and the name shown on their dashboard (hom-creators-session). hc-activity-visit and hom-creators-session go when the tab closes; the rest stay until the Ambassador clears their browser’s storage.

Ambassador credit: your choice

• hom_ref: when you arrive through a House Ambassador’s link or shop page, this cookie remembers which Ambassador, so they are credited if you order. It holds only their shop address, nothing about you, and lasts 30 days.
• hom-creator-v1: in your browser’s storage, the Ambassador’s first name and code, so your cart can show whose code is coming along. It lasts the same time.
• Link clicks: when you open an Ambassador’s link (their shop page, or a product or collection link that carries their name), our server counts the click, once a day, so we can see how many people their link brings. It uses no cookie and stores nothing on your device. To count you only once, it makes a one-way code from your network address and browser details, and a second from your network address alone so one network can’t add more than a few clicks a day; the codes change every day and are deleted after about two days.
• You can turn all three off with Only what’s needed, with the cookie button at the bottom right of any page or below. If your browser sends the Global Privacy Control signal and you haven’t chosen, we treat that as Only what’s needed. An Ambassador’s code that you type in yourself still works either way, because you asked for it.

Visit counts

• When you open a page, a small script from our website host, Vercel (Vercel Web Analytics), counts the visit: the page, the site that sent you there, your approximate location, and your kind of device, operating system and browser. It uses no cookie and stores nothing on your device. To count you only once, Vercel makes a one-way code from your visit and discards it after 24 hours. We see only totals.
• Only what’s needed turns this off too, and so does the Global Privacy Control signal when you haven’t chosen, the same as the Ambassador credit above.

Set by others

• Cloudflare: the “are you a person” check on the sign-in, email sign-up, Ambassador application and privacy request forms. Cloudflare may set its own cookies or use your browser’s storage while it runs. It loads only on those forms.
• Stripe: when you pay, you are on Stripe’s own page, which sets its own cookies under Stripe’s policy.

Changing your choice

Use the two buttons under this policy to change your choice at any time. You can also clear cookies and storage for this site in your browser’s settings; if you clear the sign-in cookies you’ll be signed out.