What we store.
And what we ask first.
Last updated 23 August 2026
The short version
Almost everything ModeRedux stores on your device is there to make the site work — to keep you signed in, to protect the forms against forgery, and to remember the language and currency you picked. None of it advertises to you, none of it follows you to other sites, and we sell none of it.
There is exactly onething we ask permission for: masked recordings of how a page behaved — used both to find faults and to see which parts of a page people actually use. That stays off until you allow it, and you can change your mind at any time using “Cookie settings” at the bottom of any page.
We also count visits, which is not the same thing and is not something we ask about. That counting is done by software we run ourselves, it sets nothing on your device, and it is described in full below.
The rules that apply here cover more than cookies — they cover anything stored on your device. So this page lists browser storage entries alongside cookies, because from your point of view there is no difference.
Essential — no permission asked
These are required for the site to function or to keep it secure. The law lets us set them without asking, and the site cannot work without them.
| Name | Purpose | Lasts |
|---|---|---|
authjs.session-token | Keeps you signed in. | Until you sign out or it expires |
authjs.csrf-token | Stops another site submitting forms as you. | Session |
authjs.callback-url | Returns you to the right page after signing in. | Session |
authjs.pkce.code_verifier | Secures the Google or Apple sign-in handshake. Only set while signing in that way. | A few minutes |
payload-token | Signs in staff to the admin interface. Never set for ordinary visitors. | Session |
NEXT_LOCALE | Remembers which language to show. | Session |
mr_consent | Remembers the diagnostics choice you made on this page. | 6 months |
mr_currency | Browser storage, not a cookie. Remembers your display currency. | Until you clear it |
In production the first four carry a __Secure- or __Host- prefix, which tells your browser to refuse them over an insecure connection.
Counting visits — no permission asked
We count page views so we know which parts of the site are used and which are ignored. This is done with Umami, which is software we run on our own server — not an account with an analytics company. Nothing about your visit leaves our infrastructure, and there is no third party in this to share it with.
| What is recorded | How you are counted | Kept for |
|---|---|---|
| Which page, when, how long, the site that sent you, the browser and device type, and the country your connection resolves to. | Not by a cookie, and not by an identifier stored on your device. Our server derives a temporary code from your network address and browser, which is discarded and cannot be recreated afterwards. | The visit itself is kept as statistics; the temporary code does not outlast the day. |
| How quickly pages loaded and responded on your device. | The same way. These are timings, not a profile. | As statistics |
| Which buttons and links were used — for example that a search returned nothing, or that a listing was opened at a marketplace. | The same way. | As statistics |
If you have an account and are signed in, your visits are linked to a code derived from your account so we can tell a returning member from a new one. The code is scrambled with a key only our application holds — the counting software never sees your name, your email address or your account number. Signed-out visits are never linked to anyone.
This is audience measurement for our own site, it does not follow you anywhere else, and it is not used for advertising or profiling. That is why it is here rather than behind the permission banner. Recording your screen is a different matter, and is next.
Recordings — only with your permission
We use Sentry to tell us when the site breaks. Basic error reports — what failed and where in our code — are collected without storing anything on your device, and we treat them as necessary to keep the service working.
Beyond that, two tools can record how a page behaved while you were on it. Neither runs unless you allow it, and one choice covers both:
| Name | Purpose | Lasts |
|---|---|---|
sentryReplaySession | Session replay — a recording of how the page behaved, so we can see which combination of filters led to a fault. | Session |
sentry_previous_trace | Performance tracing — links page views so a slow response can be traced end to end. | Session |
| No stored entry | Performance profiling — samples which code was running when a page was slow. Chromium browsers only. | — |
| No stored entry | Session replay and heatmaps, on our own server — a masked recording of the page, and from it a map of where visitors click and how far down they scroll. Only a sample of visits is recorded. | Recordings are deleted after 30 days |
What a recording does and does not contain.Both are masked before they leave your browser: form fields are always hidden, and in Sentry’s case all text is replaced with placeholder blocks and images and video are blocked entirely. What we get is the shape of the page and the sequence of interactions — which filters were used, in which order, what the layout did — not your keystrokes. We instruct Sentry not to attach your IP address. Nothing collected here is used for advertising, profiling or measuring you, and it is never sold.
Sentry processes this data for us in the United States. The heatmap and replay recording stays on our own server and is not sent anywhere. If you would rather not allow either, decline — the site works identically, and we still count your visit the ordinary way described above.
Other services that see your request
Some parts of a page are fetched from other companies. They do not set cookies through us, but loading them does reveal your IP address to those companies, which is worth knowing.
| Who | When | Why |
|---|---|---|
| eBay and Vestiaire Collective image servers | When listing photographs load | The photographs belong to the marketplace and are served from theirs. |
| Google, Apple | Only if you choose to sign in with them | Handles that sign-in. |
Typefaces are not in that list: they are served from our own domain rather than from Google Fonts, so displaying this page reveals nothing to anyone but us.
When you click through to a listing, that marketplace may set its own cookies once you are on their site — including, on some links, one that credits us with the referral if you buy. Those cookies are theirs and are governed by their policies, not this one. The affiliate relationship never changes the price you pay or the order results appear in.
Changing your mind
Use Cookie settings in the footer of any page. Declining is exactly as easy as allowing, takes effect immediately, and stops any recording already in progress without sending it. If you have an account, the choice is saved to it so you are not asked again on your phone.
Your browser can also block or delete anything on this page. The essential entries are the exception: blocking those will sign you out and may stop forms working.
We ask again after six months, and sooner if we materially change what is collected — in which case the version below changes and the earlier choice no longer stands.
Versions of this notice
Each version records what the consent banner asked for at the time, so a choice can always be matched to what it was a choice about.
| Version | From | What it covered |
|---|---|---|
| v2 | 23 August 2026 | Adds our own session replay and heatmaps to the same single choice. Anyone who answered v1 is asked again, because v1 did not ask about this. |
| v1 | 23 August 2026 | Error diagnostics: Sentry session replay, performance tracing and profiling. One choice, no sub-options. |
Contact
Questions about anything on this page can go to [email protected]. Our privacy policy covers everything else we hold.