What we store
The full inventory. It's short.
No cookies for visitors. One entry in your browser's localStorage, set by this site, one cookie that only crew phones ever get, and one for passengers who sign in to My Rat Pass. Here they are, in full:
| Name | What it's for | Type | How long |
|---|---|---|---|
sr_cart_id | Remembers which Shopify bag is yours, so it's still there after a reload or a wander round the site. | Strictly necessary. localStorage, not a cookie. First-party only. | Until you clear site data in your browser. The bag it points to expires on Shopify's side after about 10 days without activity. |
__Host-rp-crew | Keeps crew mode on for the Rat Pass: set only on a crew member's phone, after the crew PIN, so it can add miles to a card. Visitors never get it. | Strictly necessary. HttpOnly, first-party only. | 90 days, renewed while crew mode is in use, never longer than 180 days after the PIN; logging out deletes it. |
__Host-rp-pass | Keeps you signed in to My Rat Pass: set only after you follow the sign-in link we emailed you, so the site can show you your own card. Visitors who never sign in never get it. | Strictly necessary. HttpOnly, first-party only. | 30 days; logging out deletes it. |
That's the whole table. super-rat-spices.com sets no cookies for visitors: the two cookies above are set only on crew phones, after the crew login, and for passengers who sign in to My Rat Pass.
What we don't do
The list of things the rat doesn't collect is the long one.
- No tracking analytics. We count visits with Vercel Web Analytics, which sets no cookies, stores nothing in your browser and can't follow you from one day to the next (details in the privacy policy).
- No advertising pixels — no Meta, Google or TikTok tags.
- No third-party cookies of any kind.
- No social embeds, and our fonts are self-hosted — your browser never calls Google Fonts to draw this site.
- One exception, and it sets no cookies: product photos on the merch pages load from Shopify's image CDN (cdn.shopify.com), which sees your IP address like any server does.
So why no cookie banner? Under the GDPR, the ePrivacy rules and Spain's LSSI (article 22.2), storage that's strictly necessary to give you what you asked for — like remembering your bag, or keeping a crew phone or a signed-in passenger logged in— doesn't need consent, and there is nothing non-essential on this site to consent to. A banner would just be noise. This page exists so you know exactly what's going on.
Checkout on Shopify
Different building, different rules.
When you pay, you leave this site and land on our Shopify checkout at super-rat-spices.myshopify.com. Shopify sets its own cookies there — to make the checkout work, to prevent fraud and, depending on your region, for its own analytics — and shows its own consent banner where the law requires one.
What Shopify sets and why is in Shopify's cookie policy. What happens to your order details is covered in our privacy policy.
Your country at checkout
We guess where you are so you don't have to scroll to “Spain”.
Our hosting platform, Vercel, tells our server the approximate country your connection comes from, based on your IP address. We pass that country — just the country — to Shopify so checkout pre-selects it and shows the right prices and shipping. We don't store your IP address, and nothing about this lands in your browser.
How to clear it
One click and the crumb is gone.
Clear site data for super-rat-spices.com in your browser's settings — usually under Privacy, Site data or Cookies. That deletes sr_cart_id and your bag starts empty next visit. Nothing else needs cleaning, because nothing else is there.
Changes & contact
If we ever add a row to that table — say, a way to count visitors — this page changes first, and anything that needs your consent gets asked for properly before it's set. Questions, complaints, curiosity: info@super-rat-spices.com.