Cookie Policy
Last updated: 2026-05-11
This Cookie Policy lists every cookie our code sets. We set four cookies, all of which are classified as necessary for the service to work. We do not set any third-party cookies directly, though external services we embed (Google Maps in the footer) may set their own cookies inside their sandbox.
1. Cookies we set
| Name | Purpose | Category | Expiry | Attributes |
|---|---|---|---|---|
nairi_consent | Stores your consent decision (analytics on/off, AI chat logs on/off). HMAC-signed; tampered values are ignored. We need this to act on your decisions correctly. | Necessary (consent audit) | 365 days | HttpOnly, Secure (prod), SameSite=Lax, Path=/ |
nairi_csid | Anonymous consent-session id (256-bit hex). Pairs your visit with your consent audit trail without identifying you. The cookie value itself is a one-way cryptographic id; we store only its SHA-256 hash. | Necessary | 365 days | HttpOnly, Secure (prod), SameSite=Lax, Path=/ |
nairi_cart | Remembers your shopping cart between visits. HMAC-signed; the cookie value points at a server-side cart record holding your line items. | Necessary (cart persistence) | 30 days | HttpOnly, Secure (prod), SameSite=Lax, Path=/ |
better-auth.session_token | Keeps you signed in. Set by the Better Auth authentication framework. | Necessary | Per Better Auth config — default ≈30 days, sliding | HttpOnly, Secure (prod), SameSite=Lax |
We do not use a locale cookie. Your language is determined by the URL path (e.g., /en/...), not a stored preference.
2. Third-party iframes
The Google Maps embed in our footer may set cookies inside its sandboxed iframe. We do not control those cookies. See Google's privacy notice at policies.google.com/privacy.
3. Session replay (not yet active)
When we enable Sentry error tracking with session replay in a future release, an additional session-replay cookie will be set only if you opt in to the analytics consent category. We will update this policy at that time. As of the date above, session replay is not active.
4. How to manage or withdraw consent
You can manage your consent decisions at any time at /account/privacy. The cookies listed as "necessary" are required for the service to work and cannot be disabled through that surface — disabling them via your browser settings will break the cart, sign-in, and consent audit. We do not recommend doing that, but it is your right; instructions for each major browser are available at aboutcookies.org.
5. Contact
For any cookie-related question, email privacy@nairiflowers.com.