Cookie Policy
How we use cookies
PokeShop.it uses first-party technical cookies for sessions, authentication, form security and the guest cart, plus one cookie that records your cookie choices. With your consent it can also load third-party content, such as the Google Maps map of the shop. The shop uses no analytics, profiling or advertising tools.
On your first visit a banner lets you choose Accept all, Reject all or Customise; accepting and rejecting are equally easy, and no optional category is switched on in advance. Until you choose, only necessary cookies are used. You can change or withdraw your choice at any time with the Cookie preferences link in the footer, the small button in the bottom-left corner or the form on this page. Withdrawal does not affect what was loaded before it.
Categories
Necessary: cookies essential to deliver the service you request, listed below. They are always active and do not require consent; you can still block them in the browser, at the cost of signing in, the cart and protected forms no longer working.
Preferences: they would remember optional interface settings. No tool of this kind is active at the moment.
Third-party content: content hosted by other services and embedded in the shop's pages. At the moment this is Google Maps, provided by Google Ireland Limited, which shows the shop's location. When the map loads, Google receives your IP address and technical browser data and may read or set its own cookies; Google explains this processing at https://policies.google.com/privacy and https://policies.google.com/technologies/cookies. Without this consent the map is not loaded automatically; you can still load it once with an explicit click.
Analytics and Marketing: they would measure how the site is used or show personalised advertising. No tool of this kind is active at the moment. If one is introduced, we will update this policy and ask for your consent again before it runs.
Cookies we set
The _poke_session cookie contains encrypted first-party session state for security, form protection, temporary access and account flows. It is a browser-session cookie; the browser's session-restoration settings can affect when it is removed.
The signed session_id cookie identifies an authenticated server-side session. Ordinary access expires after 12 hours. With Remember me, the cookie and authenticated access can last up to 90 days. Logging out or revoking the session ends access earlier.
The pk_consent cookie records your cookie choices: the version of the category list, which categories you allowed and the date of the choice. It contains no identifier and is readable by the page's scripts, so that optional content loads only when allowed. It expires after six months, after which the banner asks again; it asks earlier if the categories change. The choice is kept only in your browser: we do not keep a copy on our servers.
Earlier versions of the shop stored the local-storage entry poke-essential-cookie-notice to hide the previous information notice. It is no longer used and the shop removes it automatically.
Guest cart and checkout
Cart and checkout information is held on the server rather than in additional browser cookies. The guest-cart ownership token is kept in the encrypted browser session; the database stores its digest. The guest cart expires after at most 30 days and is removed by scheduled cleanup. The browser session may end earlier, so this is not a promise of a 30-day browser cookie.
Temporary encrypted checkout information is cleared by scheduled cleanup after 30 minutes. Cookie expiry, server-record cleanup and backup retention are different: the Privacy notice explains the relevant retention criteria.
External services and separate choices
Address suggestions are requested through PokeShop.it and processed server-side by LocationIQ; the address provider's scripts and API keys are not loaded into your browser. Suggested address data comes from OpenStreetMap (© OpenStreetMap contributors, www.openstreetmap.org/copyright), processed for us by LocationIQ. If you follow a payment-provider or WhatsApp link, that external service applies its own privacy and cookie information.
Newsletter subscription, promotional preferences, cart reminders and optional campaign-link observations use separate choices, not the cookie banner. Campaign-link observations do not add browser tracking cookies.
The sign-in, registration and support ticket creation pages load Google reCAPTCHA v3 from www.google.com and www.gstatic.com to prevent automated abuse. For this security check Google may read or set its own cookies and browser storage; other shop pages do not load the service. This protection is part of the necessary category. Google's information: https://policies.google.com/privacy and https://policies.google.com/terms.
Managing storage and contacting us
Besides the cookie preferences, you can delete or block cookies and local storage through your browser's site-data settings. Removing necessary storage can sign you out, disconnect your guest cart or prevent protected forms from working; removing pk_consent makes the banner ask again. Deleting browser storage does not itself delete your account or server-side order records.
For questions or personal-data requests, contact InCloud S.r.l. at [email protected]. The Privacy notice provides the controller's details, retention information and the ways to exercise your rights.