Cookies and storage

Every page here loads Meta's pixel from connect.facebook.net. It sets a cookie on pavialeb.com called _fbp, a random code that lasts 90 days, and when you arrive from a link in one of our Facebook or Instagram ads it also keeps that click in a cookie called _fbc.

It tells Meta that a page was opened, which pieces you looked at, what went into your bag, when you started checkout, and the pieces and total of an order you placed. Pavia's code gives it none of the details you type at checkout. Meta uses this to measure and show Pavia's ads, and can connect it to your Facebook or Instagram account under its own privacy policy.

To stop it, turn off activity from other businesses in Meta's Accounts Center, use a content blocker that blocks connect.facebook.net, or clear this site's cookies. The shop works the same without it.

• Cart. What you added and in what size and quantity.
• Wishlist. Pieces you saved.
• Recently viewed. The last few pieces you opened.
• Your orders. A copy of the orders placed from this browser, so you can look one up without an account.
• Pending order. A short lived marker written while an order is being placed. It is what makes a retry after a dropped connection the same order rather than a second one.
• Catalogue cache. A copy of the products so a repeat visit paints immediately.
• Preview unlock. A flag set when the launch password is entered, so the gate does not ask again.
• Meta's cookies. _fbp and, after a click on one of our ads, _fbc, described above.
• The visit count. One item (va): the day this browser was last counted, with a random code for that day (a new one every day), whether it has come back before, and the visit in progress (when it started, where it came from, the pages opened, the time spent, what was tapped), so you count once a day and a visit once. It holds nothing about who you are.

Pavia is installable, which means a service worker keeps a copy of the pages, the stylesheet and the scripts so the shop opens without a connection.

That cache holds the site's own files, not your details. Uninstalling the app or clearing site data removes it.

Two, and each can see your network address when it is fetched:

• Google Fonts for the two typefaces. No cookie is set.
• Meta's pixel, described above.

The catalogue, the product photographs and the orders all come from pavialeb.com itself, which runs on Cloudflare. Both are described in more detail on the privacy page. Apart from Meta's pixel there is no advertising script, no Google Analytics and no social media widget anywhere on the site.

The store counts its own visits and keeps only totals for each day: how many people came and how many visits, which pages and pieces were opened, the site or app a visit came from (its name only, such as Google or Instagram, and the campaign word if the link carried one), the country, the kind of device, the browser, system and language, how long pages stayed on screen, which links were tapped (WhatsApp, call, Instagram, directions), how many pieces went into a bag and whether an order was placed, and how fast the pages showed. A visit sends two short messages to pavialeb.com, one as it starts and one as you leave, and nothing about the visit itself is kept once its numbers are added in. No cookie is set, and the store keeps no network address and no identifier: to count a browser once a day it keeps a scrambled key made from the address, the browser and the day's random code in "The visit count" item above, and deletes it two days later. With Do Not Track switched on, nothing is sent at all.

Cloudflare's Web Analytics beacon is also permitted by the site's content security policy. It is cookieless: it counts a page view and sets nothing on your device.

Your browser's Clear browsing data control removes everything above, and a private window keeps none of it between sessions. The only cost is an empty cart and a forgotten wishlist.

A content blocker that stops the site's scripts will stop the cart working too, because the cart is the script. The catalogue will still show.