Cookies and browser storage

A cookie keeps you signed in. A few values in your browser remember your settings. In the United States, Meta's ad pixel runs on a few public pages, and you can turn it off. Here is every one of them, by name.

Version 1.19 · In effect, last revised 2026-11-01

This document describes what TRNCH does today. This version applies from 2026-11-01. What you agreed to before stays on record, and the Refunds page and the Terms say which earlier terms a subscription keeps.

01Everything we set

This is the complete list: our cookies, and the settings below in your browser’s local storage and session storage. A name ending in “…” is a family of keys, one for each page, product or store it remembers. Nothing else is written by TRNCH.

Name	Where	Kind	What it is for	How long
better-auth.session_token	Cookie, first party	Strictly necessary	Holds the random token that keeps you signed in. It is HTTP-only, so no script can read it, and over HTTPS it is served with the __Secure- prefix.	30 days, or until you sign out
better-auth.state	Cookie, first party	Strictly necessary	Set only while you sign in or sign up with Google: a random value that proves the answer coming back from Google belongs to the sign-in you started. Signed and HTTP-only.	5 minutes
trnch_ref	Cookie, first party	Functional	Set only when you open an affiliate's link: which affiliate it was and when, signed so it can't be forged, so that if you make an account we know whom to pay (the Privacy Policy's affiliate part). It holds nothing about you. HTTP-only. A later affiliate link replaces it.	The affiliate's window, 30 days unless their offer says
_fbp	Cookie, first party, set by Meta's pixel	Advertising	A code Meta uses to recognise this browser, to measure our ads and show them. Only for visitors in the United States who have not turned it off.	90 days
_fbc	Cookie, first party, set by Meta's pixel	Advertising	Meta's click ID, when you came from one of our ads on Facebook or Instagram.	90 days
trnch_src	Cookie, first party	Advertising	The ad tags in the link that first brought you (such as the campaign, the video and Meta's click ID), so we can tell which ad worked. Saved with your account if you make one. Same visitors as the pixel.	90 days
trnch_visit	Cookie, first party	Analytics	A random code and the furthest step this browser reached on the way to a plan, so we can see where people stop. It goes to no one else. If you make an account in this browser, the record joins your account. Same visitors as the pixel.	90 days
trnch_reg	Cookie, first party	Advertising	A random code for one sign-up, so Meta counts the browser's event and our server's as one. Same visitors as the pixel.	10 minutes
trnch_ads_off	Cookie, first party	Strictly necessary	Remembers that you turned the pixel and ad cookies off on this browser.	1 year
td-theme	Local storage	Functional	Remembers whether you chose the light theme, the dark theme or your device's own setting, so the page does not flash the wrong one.	Until you clear it
td-rail	Local storage	Functional	Remembers whether you left the filter rail on the feed open or closed.	Until you clear it
td-feed-defaults	Local storage	Functional	How you set the feed to open in Settings (its time window, order, page size and the saved view it starts on), and whether products open in a new tab.	Until you clear it or reset it in Settings
td-contrast, td-motion	Local storage	Functional	Higher contrast and less motion, if you turned them on in Settings.	Until you clear it or reset it in Settings
td-units	Cookie, first party	Functional	Metric units for a product's package, if you chose them in Settings. Sent to us only so the page is drawn in them.	1 year, or until you change it or reset it in Settings
td-notify	Local storage	Functional	Which optional emails you chose in Settings before 25 October 2026, if you did. Settings no longer asks, and nothing reads it.	Until you clear it or reset it in Settings
trnch-theme	Local storage	Functional	An older name for the theme setting. We read it so anyone who set a theme on the previous build keeps it. We never write it.	Until you clear it
trnch-credits-noask	Local storage	Functional	That you ticked “Don’t ask again today” before using a credit: it holds that day’s date, so the question comes back the next day. Until then, a button that uses a credit uses it without asking again.	Until you clear it; it stops counting the next day
sup-starred	Local storage	Functional	The suppliers you starred on the Suppliers page, so they stay starred on this device.	Until you clear it or unstar them
sb-…	Local storage	Functional	The store builder’s own settings: which steps of putting a store on Shopify you have ticked, how your list of stores is sorted, what a new store starts with if you set it in Settings, and a store preview’s offer deadline, so its countdown doesn’t start again.	Until you clear it; a store’s ticks go when the store does
sb-offer-…	Cookie, first party	Functional	The same store preview offer deadline, only if your browser blocks local storage.	30 days
td-feed-url	Session storage	Functional	The feed you were last looking at, so the Feed link takes you back to it rather than to the top.	Until you close the tab
trnch-tz	Session storage	Functional	That your browser has already told us its time zone in this tab, so it is not sent again. The time zone itself is kept with your account (see the Privacy Policy).	Until you close the tab
feed-scroll:…	Session storage	Functional	How far down the feed you had scrolled, for each feed you open, so going back to it puts you where you were.	Until you close the tab
td-y:…	Session storage	Functional	Where you were on a page, so a reload or a change of dates puts you back in the same place.	Until you close the tab
trnch:feed-at	Session storage	Functional	The last feed page this tab showed, so Previous, past the end of the feed, goes back to it.	Until you close the tab
sb-cart:…	Session storage	Functional	What you put in the basket of a store preview, so it stays there as you move between the preview’s pages.	Until you close the tab
sb-create-…, sb-details-…, sb-built-…, sb-undo-…, sb-plan-then	Session storage	Functional	The store builder’s work in this tab: what you typed on a new store’s form and in its business details (your business name, address, phone and email, if you typed them), which store a build made, a store’s Undo and Redo, and the store to go back to after you start your plan.	Until you close the tab
trnch-onward:…	Session storage	Functional	That this tab has already opened Checkout for a price, so going back from Stripe’s page doesn’t open a second one.	Until you close the tab

Local storage and session storage are not cookies: your browser keeps them, and does not send them to our servers with your requests the way it sends a cookie. They hold settings and work in progress, and the store builder’s business details are the only thing in them that can identify you. They are listed here because the law cares about what is stored on your device, not about what it is called.

If we ever switch on a session cache or a remember-me option, two more strictly necessary cookies would appear beside the first one, and this table would list them before they did.

02What we never set

No analytics that follows you from site to site. There is no Google Analytics and no product analytics. The one analytics cookie is trnch_visit, above. The one page counter is Cloudflare Web Analytics, which sets nothing on your device (below).
No advertising tags other than Meta’s pixel and our own ad cookie, both listed above.
No session recording, no heatmaps, no A/B testing tools.
No cookie of ours that any other site can read.

The typefaces on TRNCH’s own pages are served from our own servers, not from Google’s, so loading one tells no font provider anything about you. A store preview is the exception, described below.

03Third-party content that loads in your browser

We set nothing on you, but other companies’ servers do receive a request from your browser while you use the tool, for the pictures and typefaces they host. None of them gets anything about you from us.

The Validation section of a product page

The ad check’s pictures and videos load from Meta’s servers, the demand check’s product photos from Amazon’s, and an advertiser’s logo from Google’s logo service (which is asked for the advertiser’s web address). Each sees your IP address and that the picture was requested, and may set or read its own cookies as it would on its own sites. The search-interest chart is not one of them: our server asks Google Trends for its figures, so your browser does not contact Google for it.

TikTok’s image servers

Product photographs are loaded straight from TikTok’s image network, so those servers see your IP address and the fact that an image was requested. Video covers and Meta ad pictures do not: they are copies we serve ourselves. Nor does video playback: the clip is proxied through our servers, so your browser never talks to TikTok to play it.

Google sign-in

If you signed in with Google, your profile picture in the account menu loads from Google’s servers, which see your IP address and may set or read their own cookies.

The Suppliers page

Each supplier’s small logo is asked for from Google’s logo service, which is given the supplier’s web address and sees your IP address.

Store previews

A store made with the store builder uses typefaces from Google Fonts, or, on one theme, from Shopify’s font server. When you open its preview, your browser loads them from there, and those servers see your IP address and the fact that the fonts were requested.

Cloudflare

Every request to TRNCH passes through Cloudflare’s network, which protects the site from attacks. If Cloudflare has to check that a visitor is a person and not a bot, it may set its own strictly necessary security cookies on our address, such as __cf_bm or cf_clearance, for that check only: Cloudflare’s list of its cookies.

When you press to sign up, to reset a password or to send a confirmation link, Cloudflare Turnstile checks that you are a person. Its script loads from challenges.cloudflare.com only on those pages, reads your IP address and details of your browser and device, and tells us only whether you passed. Most people see nothing; it may ask for one click.

Every page also loads Cloudflare’s Web Analytics script (from static.cloudflareinsights.com). It sets no cookie and stores nothing in your browser. When a page loads, it sends Cloudflare the page’s address (without anything after a “?”), the site that sent you, how long the page took to load, and your browser, operating system, type of device and country, which Cloudflare works out from your IP address. We see only totals. Cloudflare keeps the details for 7 days and the totals for about six months, and does not use them to track people across sites: Cloudflare Web Analytics. A content blocker that blocks it changes nothing else on the site.

Stripe

Stripe’s scripts are not on our pages. Paying takes you to Stripe’s own checkout page, where Stripe’s cookies and Stripe’s notice apply: stripe.com/legal/cookies-policy.

04Why there is no cookie banner

In the United States the law asks for a clear notice and a way to turn advertising off, not a banner: this page is the notice, and Your Privacy Choices in the footer of our public pages is the off switch. A Global Privacy Control signal turns it off too. Elsewhere, consent is what the law asks for when a site stores something on your device that is not needed for a service you asked for, so visitors outside the United States get no pixel and no ad cookies. Measured against that test:

the sign-in cookies are what signing in means (without them you would be signed out on every page, or could not finish signing in with Google), so they are strictly necessary and need no consent, and the units cookie and a store preview’s deadline cookie only hold a setting you chose or a state you saw;
the affiliate cookie is set only when you open an affiliate’s link, holds nothing about you (which affiliate and when), is read only by us and only when you make an account, and is how we keep the promise to pay the person who sent you;
the stored values are settings you chose, places you were and work in progress: your theme, your rail, the feed and the spot on a page you were on, your Settings and store builder choices, what you typed in the store builder, a preview’s basket. Your browser keeps them, and they exist to do the thing you asked for;
the ad cookies and trnch_visit are never set for them, and Cloudflare’s page counter, above, stores nothing. See the Privacy Policy.

So a banner would ask you to agree to nothing, and a banner that asks for nothing is worse than no banner. Instead, this page is the notice, and it lists every key by name.

The one open question is the third-party content described above: other companies’ servers loading in your browser on a page you opened, which may set their own cookies. We treat it as part of the tool you asked for, and we tell you it is there. If we ever show the pixel outside the United States, a consent banner will appear first there.

05Clearing them

Signing out removes the session cookie. Clearing site data for this site in your browser settings removes everything on this page at once; the tool then opens in the dark theme with the rail open, which is where it starts for everyone.

Blocking the session cookie entirely will stop you being able to sign in. There is no way around that, because that cookie is the sign-in.

Questions about anything on this page: [email protected].

Questions about this document go to [email protected], or call 480-378-9708.