Cookies

All of them are functional or security cookies: two remember a preference of yours and the rest hold up a purchase, a session or a defence against an attack. There are no advertising, profiling or third-party cookies on this domain: there is no advertising, and visit measurement uses no cookies. The only third-party tag that can load is the anti-robot check on the contact page, which has its own section further down.

The names in this list are the cookies, exactly as your browser will show them. The ones protecting something start with “__Host-”: it is a prefix the browser recognises that forces it to send them only to this exact domain and only over HTTPS, so a subdomain cannot plant one on you. The two that only remember a preference do not carry it. What we keep outside a cookie is further down, in its own list.

• “fl_locale” remembers your language for a year.
• “fl_currency” remembers the currency of your prices for a year. Today the shop publishes in one currency — Argentine pesos — in both languages, so switching language never changes the price.
• “__Host-fl_checkout” holds your purchase draft — product, package or the amount you typed, target and a random identifier for the attempt — for an hour while you complete it. That identifier is what keeps a retry or a back button from creating two orders: it is how two submissions are recognised as the same attempt so that only one order remains. Page JavaScript cannot read it.
• “__Host-fl_order_return” remembers, for a day, which order you just left to pay, so that coming back from the payment provider takes you to its tracking page. That way the return link carries nothing about your order. Page JavaScript cannot read it.
• “__Host-fl_csrf” proves a form came from a page on this site and not another one.
• “__Host-fl_session” identifies your session if you created an account and signed in. It holds an opaque identifier, never your email and never your password.
• “__Host-fl_oauth” lasts ten minutes and exists only while you go to Google to sign in and come back. Since signing in with Google is optional and is only available if the operator has configured Google credentials, today it never gets written.
• “__Host-fl_staff” identifies a team member’s session in the internal console. A buyer does not receive it.
• “__Host-fl_staff_mfa” lasts as long as an internal second-factor challenge does. A buyer does not receive it either.

Besides cookies, the site keeps a few preferences in your browser’s local storage. The difference matters: a cookie travels to our server with every request and has an expiry date; this never travels and never expires — it stays on your device until you clear the site’s data.

We only keep display preferences there. Nothing that decides a price, a permission or who you are: the server decides those, and it reads nothing from this list.

• “fl_motion” remembers that you asked to reduce the background animation. It exists only if you used that control.

To keep spam out, the anti-robot check on the contact form is Cloudflare Turnstile, it loads on the contact page alone and only if the operator has configured its keys. It runs inside a frame (iframe) served by Cloudflare from challenges.cloudflare.com: it writes no cookie on this domain, and we neither read nor write any of theirs. Inside that frame, under its own domain and its own terms, Cloudflare may store data to recognise a browser it has already verified.

The site shows no cookie banner because there is nothing to consent to separately: everything it stores is necessary for the site to work — remembering your language, holding your purchase, keeping your session and defending it — and none of it serves advertising, measuring you or following you across sites.

The anti-robot check is a security measure, is in plain view on the form itself with its notice, and serves neither advertising nor measuring you. As for measurement: visits to public pages are measured with Vercel Web Analytics and Speed Insights, with no cookies and without identifying you, and an order, account or checkout page is never reported; since it writes nothing to your browser and builds no profile of you, it does not ask for your consent. If we ever add advertising, or a measurement that uses cookies or identifies you, this page gets updated and the site asks for your consent before switching it on. You can delete the cookies from your browser whenever you want; without them you will not be able to complete a purchase or keep a session.