Legal
Cookie Policy
The cookies and local storage this site uses, and how to control them.
Draft — pending attorney review
This document is placeholder text written to establish structure and tone. It is not legal advice, has not been reviewed by counsel, and is not enforceable as drafted. Bracketed placeholders must be completed and the whole document reviewed by a licensed attorney before launch.
Last updated: Draft — not yet published
1. What we use
Strictly necessary storage: this site keeps your cart in browser local storage under the key echo-peps.cart.v2 so it survives a reload. It contains product slugs and quantities only, and is not transmitted to us until you check out.
Attestation cookie: once you complete the research-use and age acknowledgement, we set a cookie named echo_attestation so you are not asked again for 90 days. It is strictly functional/essential — it records only that the acknowledgement was completed and when, nothing about your browsing — and is not used for analytics, advertising, or tracking. It expires automatically 90 days after it is set.
Session and security cookies: echo_session is set once you create an account at checkout, used for sign-in state and to protect forms against abuse.
Analytics: [PENDING — no analytics provider is integrated yet. When one is added, list the provider, each cookie it sets, its purpose, and its lifetime here.]
2. Consent
[NOT YET IMPLEMENTED — ATTORNEY REVIEW REQUIRED: a consent banner is required before any non-essential cookie is set for visitors in the EU, UK, and several U.S. states. Non-essential cookies must be blocked until consent is given, and consent must be as easy to withdraw as to give. Wire the banner to the analytics integration point, not merely to a UI toggle.]
3. Managing cookies
Most browsers let you block or delete cookies and clear local storage in their settings. Blocking strictly necessary storage will empty your cart on reload and may break checkout.
4. Changes
This policy will be updated whenever we add or remove a cookie or a third-party integration.
Questions about this policy? Contact our compliance team.