Cookie Policy
Short version: the site needs a handful of local values to work, and asks before loading anything that measures you.
Last updated: 10 October 2026
Your current choice
Analytics and marketing scripts are not loaded until you agree, and each category is agreed to separately. If you choose “essential only”, Google Analytics, Microsoft Clarity and Google Ads are never inserted into the page at all — this is not a setting that merely tells them to behave.
Essential storage
These are needed for the site to function. They cannot be switched off, and they are not used to track you across other websites.
| Name | Kind | What it does | How long |
|---|---|---|---|
| NEXT_LOCALE | Cookie | Remembers the language you picked in the switcher | Up to a year |
| virar.consent.v1 | Local storage | Your answer to the cookie banner, so it stops asking | Until you clear it |
| virar_consent | Cookie | Remembers the choice you made here, so the banner does not ask again on every page. Held as a cookie as well as in local storage because some browsers will not let us write the local copy, and a choice that does not survive the page is not a choice | 12 months |
| virar_hints_enabled_v1 | Local storage | Whether you want the builder's hints shown | Until you clear it |
| virar_template_hints_dismissed_v1 | Local storage | Which hints you have already dismissed | Until you clear it |
| virar_color_usage_v1 | Local storage | The colours you recently used, so they stay to hand | Until you clear it |
The local-storage entries never leave your browser — they are not sent to our servers. The two cookies are different: a browser attaches a cookie to every request to the site that set it, so NEXT_LOCALE and virar_consent do reach us. We use them only for what the table says, and neither identifies you.
Analytics cookies
Only set if you agreed. We use them to find out where the card builder confuses people — which step gets abandoned, which button never gets pressed.
| Name | Set by | What it does | How long |
|---|---|---|---|
| _ga, _ga_* | Google Analytics 4 | Distinguishes visitors and sessions for aggregate statistics | Up to 2 years |
| _clck, _clsk | Microsoft Clarity | Links a session to its recording, so we can watch how the interface was used | Up to a year |
Clarity records sessions — mouse movement, clicks, scrolling and the layout of the pages you saw. That is the honest reason it sits behind consent rather than in the essential list. It is used to fix the interface, not to identify you, and we do not try to match a recording to a person.
Marketing cookies
Only set if you agreed to marketing cookies — agreeing to analytics alone does not load them. We use Google Ads to see which of our ads lead to a visit or an order, so we stop paying for the ones that don't.
| Name | Set by | What it does | How long |
|---|---|---|---|
| _gcl_au | virar.io | Remembers that you arrived from one of our ads, so a later visit or order can be attributed to that ad | 90 days |
| _gcl_ls | virar.io (Local storage) | A copy of the ad-click information kept in local storage instead of a cookie, so a later visit or order can still be attributed to the ad that brought you here. Written by Google Ads, read only on this site | Until you clear it |
| virar.attribution.v1 | virar.io (Local storage) | Which ad or link brought you here (campaign tags and the ad click ID), so the order you place can be matched to that ad. Kept on our side with your card; never shared | 30 days |
| IDE | doubleclick.net | Set by Google on its own advertising domain to measure whether an ad led to a visit or an order | Up to 13 months in the EEA, the UK and Switzerland |
| NID | google.com | Carries your Google preferences and is used to measure our ads; set by Google, governed by Google's own privacy policy | 6 months |
Google may set further cookies of its own on these domains, and the exact set changes over time — the rows above are the ones this site causes. We do not ask Google to build an advertising profile of you: personalised advertising stays switched off, so these are used to count whether an ad worked, not to follow you around other sites.
Payment cookies
On the payment step, Stripe sets its own cookies (such as __stripe_mid and __stripe_sid) to detect fraud and keep the payment form working. They are set by Stripe, not by us, and only on the page where you actually pay. Without them a payment cannot be taken safely, so they count as essential to that step — see Stripe's privacy policy.
Controlling cookies yourself
Beyond the controls at the top of this page, every browser lets you view, block and delete cookies and site data for a given site. Blocking everything will break parts of the builder that store your preferences locally, but it will not stop you from ordering a card.
What happens to the rest of your data is covered in the Privacy Policy.