Cookies
The essential ones, and the rest.
Last updated 13 July 2026. Cookies are small files your browser stores. Beyond those, we keep a few things in your browser's local storage. Some are required for the site to work, others are optional. You choose.
Essential cookies
Without these the site doesn't work. They keep you signed in, remember your language and your basket, and store your cookie choice. They don't ask for permission because they're technically necessary.
Analytics cookies (optional)
Help us understand which pages get read, where people get stuck and what needs improving. They only load after you accept. We use two tools. Vercel Speed Insights measures Core Web Vitals in aggregate, without persistent cookies. PostHog, hosted in the European Union, records pageviews and usage events and stores an identifier in your browser. If you're signed in, it links those events to your account through an internal identifier, never through your name or email. Vercel Web Analytics is disabled. We don't use Google Analytics or advertising pixels, and we don't sell this data.
Marketing cookies
We don't use any. No remarketing, no Facebook pixels, no third-party ad tracking.
Third-party services
Some features rely on external services that store data in your browser. Stripe (secure payment), Cloudflare Turnstile (anti-spam protection on forms), and Google Maps (address autocomplete). These are functional, not used for advertising, and are listed in the table below.
Cookies and local storage, the difference
Not everything we store is a cookie. A cookie travels with every request to the server and has an expiry date. Local storage stays only in your browser, never travels to the server, and remains until you clear it. We use both. The table below says which is which.
Changing your choice
A banner shows up in the footer on your first visit. You can change at any time by clicking “Cookies” in the footer. If you prefer, clear the site's cookies and storage in your browser and the banner returns.
Detailed list
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sb-…-auth-token | Cookie | Keeps you signed in (Supabase) | While the session is active |
| lavora-locale | Cookie | Chosen language | 1 year |
| lavora_ref | Cookie | Stores the code when you arrive via an invite | 30 days |
| lavora.cookie-consent | Local storage | Remembers whether you accepted cookies | Until you clear the browser |
| lavora.cookie-preferences | Local storage | Remembers the categories you accepted | Until you clear the browser |
| lavora.cart.v5 | Local storage | Basket items | Until you clear the browser |
| ph_…_posthog | Cookie and local storage | Usage analytics (PostHog). Only after you accept | 1 year |
| __stripe_mid | Cookie (Stripe) | Payment security, fraud prevention | 1 year |
| __stripe_sid | Cookie (Stripe) | Payment session | 30 minutes |
| Turnstile | Storage (Cloudflare) | Anti-spam check on forms | Session |
| Google Maps | Cookie (Google) | Address autocomplete | Set by Google |
Who processes the data
More on privacy at /privacidade.