Forged & FoundJewellery sourced, selected and developed with care.
© 2026 Forged and Found Ltd. Registered in England and Wales. Company no. 17045653. Registered office: Birmingham Assay Office, 1 Moreton Street, Birmingham, England, B1 3AX. VAT registration no. 268 6187 58.
Last updated 2 September 2026
Cookies and similar technologies are small files or tools that store or access information on a device. They can keep the website secure, remember choices, measure performance and, where enabled with the required permission, support marketing. This policy covers this website and the Shopify-hosted checkout it hands you over to.
Only strictly necessary technologies are used until you choose to allow more. Analytics and advertising cookies are not set unless you allow them — either with Accept all on the cookie banner, or category by category under Preferences, where you can also reject everything. Closing the banner without choosing is treated as a refusal for that visit — nothing non-essential is set, and you will be asked again next time.
You can change your mind at any point through the Cookie settings link in the footer. A recorded choice is kept for 6 months, after which you will be asked again, and it is passed to the Shopify-hosted checkout so the same choice applies there. Strictly necessary technologies cannot be switched off because the requested service cannot operate without them.
Required for the website to work: signing in, keeping a basket, security and fraud prevention, and remembering this cookie choice. These are not switched off by the cookie banner because the requested service cannot operate without them.
| Name | Set by | Retained | Purpose |
|---|---|---|---|
| ff_consent | Forged & Found | 6 months | Records your cookie choice so you are not asked again on every page. |
| authjs.session-token | Forged & Found | 30 days | Keeps you signed in to your account. Only set once you sign in. |
| authjs.csrf-token | Forged & Found | Session | Protects sign-in and account forms against cross-site request forgery. |
| authjs.callback-url | Forged & Found | Session | Returns you to the page you were on after signing in. |
| authjs.pkce.code_verifier, authjs.state, authjs.nonce | Forged & Found | 15 minutes | Short-lived values that secure a sign-in started with Google or Apple; deleted as soon as the sign-in completes. |
| shopify-cart-id (local storage) | Forged & Found | Until cleared | Remembers your basket between visits so it is not lost when you close the tab. |
| cart-max-quantities (local storage) | Forged & Found | Until cleared | Remembers the stock limit reached on a basket line so the quantity control stays accurate. |
| shopify-favourites (local storage) | Forged & Found | Until cleared | Holds a wishlist created before you sign in, so it survives until it can be saved to your account. Set only when you add something to your wishlist. |
| search:history (local storage) | Forged & Found | Until cleared | Shows your recent searches back to you. Set only when you search. |
| ff:recently-viewed (local storage) | Forged & Found | Until cleared | Powers the “Recently viewed” row on product pages. |
| ff:marketing:* (local storage) | Forged & Found | Until cleared | Remembers that you dismissed or accepted the email-subscription invitation, so it is not shown again. |
| ff:consent:deferred (session storage) | Forged & Found | Until the tab is closed | Remembers that you closed the cookie banner without choosing, for this tab only. |
| _shopify_y, _shopify_s | Shopify | 1 year / 30 minutes | Set by Shopify when you go to checkout, to run the checkout and keep it secure. Checkout is hosted by Shopify on its own address. |
| cart, cart_ts, cart_sig, secure_customer_sig | Shopify | Up to 1 year | Carry your basket and your signed-in state through Shopify's checkout. |
| _cmp_a, _tracking_consent | Shopify | 1 year | Record your privacy and tracking choice on Shopify's checkout pages. |
Measure how the website is used — which pages and products are viewed, and where a visit ends — so the site can be improved. Only set after you accept.
| Name | Set by | Retained | Purpose |
|---|---|---|---|
| _ga | Google (Google Analytics 4) | 2 years | Distinguishes one visitor from another so visits can be counted. |
| _ga_* | Google (Google Analytics 4) | 2 years | Keeps the state of the current session for Google Analytics. |
Allow Google Analytics' advertising features (Google signals): cross-device reporting and audiences built from activity on this website, linked to a Google account where one is signed in with ads personalisation on. Sets no cookies of its own beyond the analytics ones, and is only used after you allow it. The same choice is passed to the Shopify-hosted checkout.
You can also block or delete cookies through your browser. Doing so may affect checkout, saved preferences or other website functions, and it will clear the record of your cookie choice, so the banner will appear again.
