Cookie Policy

1. What Is a Cookie?

A cookie is a small text file a website places on your device. It lets the site recognize your browser on later visits, keep you signed in, remember preferences, and measure how the site is used. Some cookies are first-party (set by Khojj); others are third-party (set by services we use, such as our payment processor or analytics provider).

2. Categories We Use

Strictly necessary

Required for core functionality. You cannot opt out of these without breaking the site.

• next-auth.session-token — keeps you signed in.
• khojj_cart — signed cookie that links your cart across visits.
• khojj_consent — remembers your cookie-banner choice.
• CSRF / origin-protection tokens.

Functional

Set when you customize the site. Disabling these means the site forgets your settings.

• khojj-theme — light / dark mode preference.
• Country and currency preferences.

Analytics (optional)

Help us understand which pages are useful. We only set these if you choose "Accept all" in the consent banner. We do not sell analytics data to third parties.

Marketing (optional)

We do not currently run ad-tracking pixels. If we add them, we will update this policy and require opt-in consent where the law requires it.

Third-party services

• Stripe — sets cookies on checkout pages to detect fraud and complete payment. Required for paid orders.
• Google — used only when you choose "Sign in with Google."
• Vercel — anonymous infrastructure cookies for routing and security.

3. Managing Your Choices

• Use the cookie banner that appears on your first visit to accept all or essential-only cookies. Your choice is remembered for one year.
• Clear the khojj_consent cookie in your browser to be re-prompted.
• Most browsers let you block or delete cookies in their privacy settings. Disabling strictly-necessary cookies will break sign-in and checkout.
• You can request deletion of your account-tied data anytime — see the "Your Rights" section of the Privacy Policy.

4. Do-Not-Track Signals

We currently do not run cross-site tracking, so we honor "Do Not Track" signals by default for analytics. If you also send a Global Privacy Control (GPC) signal, we treat it as an opt-out request under California (CCPA) and EEA (GDPR) rules.

5. Changes to This Policy

If we change the cookies we use, we will update the "Last updated" date and, where the change is material, re-show the consent banner so you can review your choice.