Cookie policy
Last updated 23 October 2026.
This site uses only what it needs to work, plus one simple visitor count. There are no advertising cookies and no tracking across other websites, so there is no cookie banner to click away.
Visitor statistics
We use Cloudflare Web Analytics to count visits: which pages are viewed, roughly which country visitors come from, the website that sent them, the type of device and browser, and how quickly pages load. It sets no cookies, stores nothing on your device, does not follow you to other websites and is not used to identify you. Cloudflare provides it as part of hosting this site and processes it on our behalf.
You can switch it off here. It takes effect straight away on this device: the counting script is no longer loaded, so nothing about your visits is sent, and the site works exactly the same. If your browser sends a Global Privacy Control signal we treat that as no without you doing anything.
Your visits are being counted.
Cookies
| Name | What it does | Lasts |
|---|---|---|
| ih_session | Keeps you signed in. Set only when you sign in | 30 days |
| ih_u | Tells the page you are signed in, so the header can show your account. Holds no personal detail | With your session |
| ih_id | Your account number, so the header can load your photo | With your session |
| ih_next | Remembers the page to send you back to after signing in | 15 minutes |
| __cf_bm and similar (Cloudflare) | Tells bots from people and keeps the site online | 30 minutes, some up to 1 year |
| Stripe cookies (checkout page) | Fraud prevention. Stripe's payment form loads as soon as the checkout page opens, before you enter a card, so these are set on any visit to the checkout | Up to 1 year |
Stored on your device
These are not cookies and are never sent to us. They stay in your browser.
| Name | What it does | Lasts |
|---|---|---|
| instahit.bag.v1 | Remembers what is in your bag on this device | Until you clear it |
| instahit.bag.pending.v1 | Remembers which bag lines were set aside for a payment you started, so the right ones are removed once it succeeds | Until you clear it |
| instahit.adult | Remembers that you answered the 18+ question on this device | Until you clear it |
| instahit.attempt (session storage) | Identifies the payment you started so a refresh resumes it rather than charging twice | Until the tab is closed |
| instahit.adult | Remembers that you confirmed you are 18 or over | 30 days |
| instahit.noAnalytics | Remembers that you asked us not to count your visits. Set only if you press the button above | Until you clear it |
| instahit.offersSeen | Remembers that you have looked at the offers page, so the badge stops showing for a fortnight | Until you clear it |
You can clear all of these at any time in your browser settings. If you do, your bag will empty, we will ask your age again, you will be signed out, and your visits will be counted again until you switch it off here.
