Cookies
Cookie policy.
Last updated: 2 July 2026
This policy explains how Kovalabs (operated by Floww Group Limited, the data controller) uses cookies and similar technologies such as browser local storage on this website. It sits alongside our Privacy Policy, which describes how we handle your personal data more broadly. We follow the UK Privacy and Electronic Communications Regulations (PECR) and the UK GDPR.
What cookies are
A cookie is a small text file a website stores on your device so it can recognise your browser. We also use related technologies, such as local storage, that work in a similar way. Throughout this policy we use the word “cookies” to cover both.
Cookies do a range of jobs: some are essential to make the site work (keeping your basket, keeping you signed in), while others are optional and help us understand how the site is used or support our marketing.
How we ask for your consent
When you first visit, we set only the strictly necessary cookies the site needs to function. Under PECR these do not require your consent, so they are always on.
Optional cookies (analytics and marketing) stay switched off unless you choose Accept on our cookie banner. Clicking Decline keeps the same cookieless mode active: no cookie is set, no device storage is used for analytics, and there is no cross-visit identity. This anonymous, aggregate measurement continues under our legitimate interest and the Data (Use and Access) Act 2025 statistical purposes basis. You can object at any time by emailing privacy@kovalabs.co.uk. Nothing in the analytics or marketing categories below is set unless you opt in.
If you accept, we record your choice for 365 days so we do not ask on every visit. If you decline, we record that choice for 7 days; after it expires we may show the banner again on a later visit. Refusing is exactly as easy as accepting, and you can change your mind at any time using the Cookie settings link in the footer.
Your choice is set per device. The law treats cookie consent as specific to the device and browser you are using, so if you visit us on another device - for example you join our newsletter on your phone and later open an email on your laptop - you will be asked again on that device. A choice you make on one device does not carry over to another, and each device's choice is respected on that device.
When you are signed in, or you give us your email (for example by joining our newsletter or at checkout), we also keep a record of the choice you made on each device - the choice itself, the time it was made, and the IP address and browser it came from - stored against your email on our own servers. We use this only to honour your choice and to be able to demonstrate, if we are ever asked, that you gave it. It sets no additional cookies. You can ask for a copy of this record, or ask us to erase it, using the contact details in our Privacy Policy.
Strictly necessary cookies
These are required for the site to work and cannot be switched off. They do not track you for advertising. All are set by Kovalabs (first-party).
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _medusa_cart_id | Kovalabs | Remembers the items in your basket between pages and visits. If you arrived through a referral partner's link, the basket record it points to also notes the referral code and click time - at the moment you arrive when the link carries your 10% partner discount, or once you start a basket during that visit otherwise - so the partner can be credited and any discount applied at checkout. The same happens when you use the apply link in our welcome email: the basket record notes your personal welcome code so it applies at checkout. These notes live on our server, not in the cookie. | 30 days |
| _medusa_cart_summary | Kovalabs | Lets the basket count appear instantly when a page loads, before the full basket is fetched. Holds only an item count and total, never personal details. | 30 days |
| _medusa_jwt | Kovalabs | Keeps you signed in to your account as you move between pages and between visits, so you do not have to sign in again each time. Refreshed while you are active. | 365 days |
| _medusa_cache_id | Kovalabs | Makes sure cached pages show your own basket and account state rather than another visitor's. | 30 days |
| kova_analytics_consent | Kovalabs | Records your cookie choice on this device so the banner is not shown on every visit. | 365 days if you accept; 7 days if you decline |
| kova_device_id | Kovalabs | A random identifier for this device. Because cookie consent is set per device, we use it only to keep a record of YOUR own cookie choice straight when you use more than one device. It is not used for advertising or to build a profile of you, and it is never shared. Stored in your browser's local storage. | Until you clear your browser storage |
| kovalabs_age_gate_accepted_v1 | Kovalabs | Remembers that you confirmed you are 18 or over, so the age check is not shown on every visit. Stored in your browser's local storage. | Until you clear your browser storage |
| _kovalabs_last_address_v1 | Kovalabs | Remembers the shipping address and email you used at your last checkout so your next checkout on this device can pre-fill the form. Stored in your browser's local storage. You can clear it any time from the address form at checkout. | Up to 180 days, or until you clear it from the checkout form |
| kovalabs_email_popup_seen_v1 | Kovalabs | Remembers that you dismissed the email signup popup so it is not shown on every visit. Stored in your browser's local storage. Holds no personal details and does no tracking. | Until you clear your browser storage |
Analytics cookies (optional)
These help us understand how visitors use the site so we can improve it. They are set only if you accept. Our analytics provider is PostHog, whose servers are hosted in the EU. See PostHog's own privacy notice for how they process data on our behalf.
If you accept analytics cookies, we also measure how you interact with pages, such as where you click, how far you scroll, and which elements get the most attention (sometimes shown as a heatmap), so we can improve the layout. This interaction measurement runs only after you accept; before that, analytics run with no cookie and no cross-visit identity.
If you accept analytics cookies, we may also record a replay of your visit: the pages you view, clicks, scrolling, and mouse movement. We use replays to find and fix problems with the site. Replays are only captured after you accept. Text you type into forms is masked before it leaves your browser, so passwords, addresses, and payment details are not visible in a replay.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| kova_ph | PostHog | Recognises your browser between visits so we can measure how the site is used over time and improve it. Also links session replays to your visit if you accept analytics cookies. Set only after you accept; before that, analytics run with no cookie at all. | Up to 365 days |
| kova_attr | Kovalabs | Remembers how you first arrived at the site (for example a search engine or a campaign link) so we can understand which channels bring visitors and orders. Set only after you accept analytics cookies; before that, the same information is kept only for your current visit. | 365 days |
We also use Vercel Web Analytics for anonymous page-performance measurement (load speed and Core Web Vitals). It sets no cookies and stores nothing on your device, which is why it has no entry in the tables on this page; it behaves the same whichever cookie choice you make.
Marketing cookies (optional)
These support our marketing, such as crediting orders to a referral partner. They are set only if you accept. Our email marketing runs server-side and sets no cookies in your browser.
If we add advertising tools in future (for example a Meta or Google advertising pixel), we will list their cookies in this table and ask for your consent again before they go live, with a separate choice for advertising.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| affiliate_ref | Kovalabs | Stores the referral code from a partner link so eligible orders can be credited to that partner. Orders qualify for partner commission only when placed within 90 days of the click; the longer-lived record is used for our own marketing measurement. Set only after you accept analytics and marketing cookies. | 365 days |
| affiliate_ref_at | Kovalabs | Records when the partner link was clicked, alongside affiliate_ref, so the 90-day commission window can be applied correctly. Set only after you accept analytics and marketing cookies. | 365 days |
| affiliate_ref_src | Kovalabs | Records the sub-source tag from a partner link (for example which social platform or post it came from), alongside affiliate_ref, so partner traffic can be measured by channel. Set only after you accept analytics and marketing cookies. | 365 days |
Changing or withdrawing your choice
You can review or change your choice at any time using the button below, or the Cookie settings link in the site footer. Withdrawing consent is as straightforward as giving it.
You can also block or delete cookies through your browser settings. Most browsers let you refuse or remove cookies, but if you block the strictly necessary ones, parts of the site (such as your basket and sign-in) may stop working.
Changes to this policy
We may update this policy as our site and the tools we use change. The “last updated” date at the top shows when it was last revised. Any new cookie categories will be reflected here and, where required, gated behind your consent.
Contact
Questions about cookies or your data? Email hello@kovalabs.co.uk and we will respond within one calendar month.