Cookie Notice

These are strictly necessary: without them you cannot stay signed in, and sign-in cannot be protected against forged requests. They are set by our authentication library, are not readable by JavaScript, and are not used for tracking.

next-auth.session-token

Keeps you signed in. Encrypted, not readable by JavaScript, and expires after 30 days. Prefixed “__Secure-” and restricted to HTTPS when the site is served over HTTPS.

next-auth.csrf-token

Protects the sign-in form against forged requests from other sites. Deleted when you close your browser.

next-auth.callback-url

Remembers where to return you after signing in. Deleted when you close your browser.

next-auth.state · next-auth.pkce.code_verifier

Set only if you use “Continue with Google”, and only for the few minutes that sign-in takes. They secure the handover between this site and Google.

ref

Set when you arrive through a partner link containing ?ref=. It stores that partner’s code for 30 days so they are credited if you order. It is readable by JavaScript, because the checkout has to send it.

This one is not strictly necessary. It exists to attribute commission, which is a marketing purpose, and in the EU and UK that normally means it should be set only with your consent.

We are not currently asking for that consent — there is no cookie banner on this site, and the cookie is set as soon as you follow a referral link. We would rather tell you that here than pretend otherwise. A consent mechanism is required before launching in the EU or UK.

You can delete it in your browser at any time, or visit the site without a ?ref= link and it is never set. Nothing about the site stops working without it — the only effect is that no partner is credited for your order.

checkmate-cart-v1

Your shopping bag, kept in your browser’s local storage so it survives a refresh. It holds product ids, quantities and prices — no personal data, and it is never sent anywhere except when you check out. Clearing your site data empties your bag.

checkmate-concierge-v1

Your concierge chat history, kept in local storage so the conversation survives a refresh. It exists only if you use the chat, and it never leaves your browser except as context when you send your next message. The chat’s “Clear conversation” button removes it, as does clearing your site data.

No analytics cookies. No advertising or retargeting cookies. No social media pixels. No session-replay or heatmap tools. No third-party scripts run on this site at all, and our fonts are served from our own server rather than fetched from Google.

One exception, and it is yours to trigger: pressing play on a film in the video library loads a YouTube player, and Google may then set its own cookies in your browser. Nothing loads from YouTube until you press play — the library's thumbnails are served from our own server — so no video cookie exists unless you chose to watch something.

We do measure how the site is used, but not with cookies. That measurement keeps a random identifier in your browser tab's temporary storage (sessionStorage), which is not a cookie: it is never attached to a request, it is not shared between tabs or with any other site, and the browser destroys it when the tab closes. Closing this tab removes it; there is nothing to opt out of and nothing to delete. Our Privacy Policy describes exactly what is recorded.

Stripe sets its own cookies while you are on its checkout page, which is on Stripe's domain rather than ours and is governed by Stripe's privacy policy.

Every browser lets you view, block and delete cookies in its settings. Blocking the authentication cookies above will prevent you from signing in; blocking or deleting ref has no effect on you.

Questions: privacy@checkmatepeptides.com. What we do with the data behind these cookies is in the Privacy Policy.