Cookie policy

Necessary storage

Necessary storage supports functions such as the basket, sign-in security, your explicit market selection and saved cookie choices. The inventory below identifies names, purposes, providers and lifetimes. Blocking necessary storage in your browser may prevent these functions from working.

Optional website services

Optional analytics, including Google Analytics when enabled, load only after you give the relevant consent. You can continue shopping if you decline optional cookies.

Changing your choice

Use Cookie settings to accept or refuse available optional categories and to withdraw consent. A changed service or purpose may require a new choice. You can also delete stored cookies through your browser; this may reset your basket, session or preferences.

Storage in the mobile app

The native app uses device storage rather than the website's basket and consent cookies. @cultco/preferences/v1 stores language and delivery choices, saved product identifiers and followed brand identifiers. cultco.cart.v1 stores basket product identifiers and quantities. Protected storage under cultco.checkout.v1 stores a random checkout recovery identifier, product quantities and market, plus a temporary basket-update record. These are app storage keys, not browser cookies. Preferences and basket data have no app-set expiry; recovery data is removed when the app safely handles a confirmed payment, cancellation or refund. Unresolved purchases can retain it until checked. See the Privacy notice for details and server-record retention. Opening the website uses the website's separate cookies and choices.

Your Circle account in the app

The app keeps a random member session token and account identifier in protected device storage under cultco.member.v1. Server sessions normally expire after 30 days; email verification codes expire after 10 minutes, have limited attempts and are stored as hashes. Expired code records are removed by the daily cleanup after a further day. Member and guest baskets and recovery identifiers have separate account-specific storage keys. Balances, email codes, contact details and Stripe payment secrets are not persisted by Cultco in app storage.

Company and policy details

Legal company name

6FIVE AB

Company postal address

Fersens väg 6, 211 42 Malmö, Sweden

Customer service email

hej@cultco.com

Cookie names, providers and purposes

Cultco's necessary first-party cookies are cultco-session (an opaque session identifier linking the browser to its basket, selected market, sign-in and form-security context), XSRF-TOKEN (a form-security token against cross-site request forgery), cultco_market (the explicitly selected language, country and currency, with version and expiry) and cultco_consent (an encrypted record of cookie choices, relevant service identity, version and expiry). The session is configured with Secure, HttpOnly and SameSite=Lax protection. If Google Analytics is enabled and you give analytics consent, its first-party _ga and _ga_WH0XPLGSHS cookies identify the browser and record measurement-stream session information for the Cultco stream G-WH0XPLGSHS. The associated measurement is processed by Google. The Analytics tag and collection requests do not load before consent, on refusal or when the service is unavailable. Analytics is limited to allowed public store pages; it excludes cart, checkout, customer accounts, order receipts, administration, brand applications and withdrawal forms. Cultco's present implementation enables no advertising or live-chat tracking. Withdrawing analytics consent in Cookie settings stops the tag, removes its first-party analytics cookies and reloads the page when needed; it does not retrospectively delete previously collected provider data. Website payment occurs on Stripe's hosted checkout, where Stripe provides its own cookie information. Blocking necessary storage may prevent sign-in or checkout.

Cookie and consent lifetimes

Live configuration was verified on 17 October 2026. cultco-session lasts 120 minutes and is renewed with session activity; it is not configured to disappear merely because the browser closes. XSRF-TOKEN follows the same configured session lifetime. cultco_market and cultco_consent last 180 days from saving the corresponding choice. The configured Google Analytics _ga and _ga_WH0XPLGSHS cookies last up to 180 days, with automatic lifetime refresh on new page views disabled. Browser privacy rules may shorten any of these lifetimes. Cookie settings in the footer lets you allow or refuse available optional categories and withdraw a previous choice. An expired consent or material service change may require a new decision. Removing cookies may also reset the basket, session or market preferences. These browser-cookie lifetimes do not set the retention of order records, emails, database sessions, provider reports or backups; see the Privacy notice for those criteria.