Legal
Cookie policy
Last updated 21 Sept 2026.
Which cookies Twenty One Perfumes sets, what each one is for, how long it lasts, and how to change what you agreed to.
A cookie is a small file a website asks your browser to keep. This page lists every cookie Twenty One Perfumes uses, along with what we store on your device that is not a cookie. For each one it says what it does, how long it stays, and who sets it.
Until you answer the banner, nothing here measures you. Google's tag is the one thing that still loads, because it is what carries your answer to Google, but while measurement is denied it sets no cookie and sends no identifier. The push notification script is not loaded at all until you allow marketing.
Strictly necessary
These are what make the shop work. They hold your basket, your language, whether you are signed in, and the answer you gave about cookies. There is no switch for them. Turning them off would empty your basket and sign you out.
| Name | What it does | How long | Set by |
|---|---|---|---|
| to_cart, to_cart_hint | Remembers the basket you are building, so it is still there when you come back. | 30 days | Twenty One Perfumes |
| NEXT_LOCALE | Remembers whether you are reading the shop in English or Spanish. | Until you close your browser | Twenty One Perfumes |
| c15t | Stores your answer about cookies, so you are not asked again on every page. | 1 year | Twenty One Perfumes |
| to_customer_access, to_customer_refresh, to_customer_id, to_customer | Keeps you signed in. The contents are sealed, so the tokens inside cannot be read out of your browser. | 30 days | Twenty One Perfumes |
| to_oauth_pkce | Holds one short-lived value while you sign in, to prove the request coming back is the one that went out. | 10 minutes | Twenty One Perfumes |
| twentyone.wishlist | Holds the perfumes you have saved on this device. Once you are signed in, your saved list lives on your Shopify account instead. | Until you clear your browser data | Twenty One Perfumes |
Measurement
These count visits, so we can see which pages are worth keeping and which searches come back with nothing. They are written only after you allow measurement, and taking that permission back stops them.
| Name | What it does | How long | Set by |
|---|---|---|---|
| _ga | Lets Google Analytics tell one browser from another, so somebody coming back is not counted as somebody new. | 2 years | |
| _ga_4P2SZYVD63 | Holds the state of your current visit for this shop's Google Analytics property. | 2 years |
Marketing
These exist only if you ask us to send push notifications. Nothing in this group is loaded until you do.
| Name | What it does | How long | Set by |
|---|---|---|---|
| /push/onesignal/ | Registers a service worker and a device identifier, so a notification can reach this browser. | Until you turn notifications off | OneSignal |
Changing your mind
Taking your answer back is as easy as giving it. This button reopens the same choices you were shown when you arrived, and what you pick takes effect straight away.
Your browser can do this too
Every browser can block or delete cookies on its own, and its help pages explain how. Blocking the strictly necessary ones will stop the basket and the sign-in from working.
Who else receives data
- Shopify
- Runs the catalogue, the basket and the checkout. Payment happens on Shopify's own pages, so this site never sees a card number.
- Google Analytics
- Receives the page views and shop events described above, and only once you have allowed measurement.
- OneSignal
- Delivers push notifications, and only if you ask for them.
- Sentry
- Receives a report when something on the page breaks. It is configured to collect no cookies, no IP address and nothing that identifies you, which is why it stores nothing in your browser and is not in the tables above.
- Vercel
- Hosts the site and keeps the ordinary server logs that serving a page produces.
What this page does not cover
This page is about what is kept on your device. What happens to your data once it reaches us, and the rights you have over it, are set out separately. Read the privacy policy