Onyx BunnyPrivacy choices
Your choices about measurement.
Optional browsing analytics and Meta advertising are off until you separately allow them. A limited server counter records daily page-load totals without following individual visitors. You can object to that counter here too.
Your Accept or Deny choice is also remembered as the essential ob-consent-choice preference in local storage, with session storage and in-page fallbacks when needed. It remains until changed or site data is cleared, so the notice does not repeatedly ask. This fallback does not renew analytics permission: analytics requires the current consent and visitor cookies; if those are unavailable or expire, tracking stays off. Adult entry can additionally use the essential ob_adult cookie for 180 days. If all persistent storage is blocked or cleared, a new visit may need the choice again.
The strictly necessary first-party ob_language preference remembers a language you select (EN, DE or ES) for up to one year, independently of analytics consent. The first-party ob_language_seen cookie stores only 1 for up to one year to keep automatic language selection to your first visit. Neither cookie contains an identifier or measures browsing. Use the language switcher to change your preference, or clear site cookies to reset it. An English link with ?lang=en also remembers English.
Optional browsing analytics
Analytics uses random browser and tab codes to record pages, clicks, page versions, active time and scroll depth. These codes are pseudonymous: they can link visits even though they do not contain your name. We do not record typed text, screen recordings, IP addresses or full user agents in the event table. Consent is the basis: Art. 6(1)(a) GDPR and applicable device-storage rules.
The heel landing comparison uses ob_heel_landing, a first-party A/B version cookie lasting up to 30 days, only after analytics consent. It stores only A or B. With consent, we measure additions to the bag, checkout starts and paid orders for that version; the version is stored on the order for payment attribution. Without consent, the page is randomly selected on each request and only anonymous daily landing totals are counted. This optional experiment cookie is not essential storage.
Analytics is currently: Off
Refusal removes the analytics visitor/version cookies and tab code. Later withdrawal stops further event dispatch. Raw detailed events are deleted after 90 days during routine cleanup; experiment aggregates are separate.
| Storage | Purpose | Duration |
|---|---|---|
ob_consent | Your analytics yes/no choice; set whichever choice you make | 180 days |
ob_vid | Random browser code, only after analytics consent | 30 days |
ob_x | Remembered page-test versions, only after analytics consent | 30 days |
ob_sid (session storage) | Random tab code, only after analytics consent | Until the tab closes or consent is withdrawn |
Limited daily page-load totals
When our server delivers a public page, it can add one to that day's approved page group, such as home, shop, product or the Instagram entry. If the page opens inside the Instagram or Facebook app, a second daily total for that app name goes up by one. No cookie, no identifier, no IP address. No raw referrer, query string, precise event time or browsing history is saved in this counter. It does not join loads to orders, share them with advertisers or count unique people. Refreshes can count again; cached visits and bots can distort totals. These are document loads, not a true bounce rate or visitor conversion funnel.
This counter uses the ordinary request needed to deliver the page, without a measurement script, pixel, fingerprint or additional device access. Its narrow purpose is website improvement; the assessment for incidental request processing is legitimate interest, Art. 6(1)(f) GDPR, with immediate aggregation and no individual profiling. Anonymous output is distinct from hosting/security request handling, described in our privacy policy. We do not treat “cookieless” as a general exemption for tracking.
New document-count totals are retained for at most 365 days with cleanup during subsequent traffic. We honour Global Privacy Control and Do Not Track request signals, exclude obvious prefetch/bot traffic and exclude owner previews.
Limited counting is currently: On
Your objection is remembered with ob_count=no, a non-identifying preference for 180 days. No passive counting cookie is set. Clearing site data also clears this preference. A browser privacy signal continues to take priority.
Page versions and aggregate steps
Some marketing pages test wording or layout. Without analytics consent, a version can be chosen afresh and its server-delivery count aggregated without an identifier, unless you have objected to limited counting. Browser interaction counts, including size choices, photo interactions, scrolling and buying steps, now require analytics consent. Older daily step totals were unlinked page-instance counts; they cannot be treated as a sequential person-level funnel. Product facts, prices, safety and purchase rules are not changed by these marketing tests.
Separate choice: Meta advertising
Only turning advertising on below allows Meta's pixel. Allowing analytics on the notice does not allow advertising. The pixel can tell Meta about a page visit and shopping steps, including a viewed product, bag action, checkout or purchase total. Meta receives IP/browser information when its script loads, can set identifiers and may connect a visit to an account. An adult-shop visit can reveal sensitive interests. We do not send names, email addresses, phone numbers or delivery addresses through this pixel.
Meta Platforms Ireland Ltd may transfer data to Meta Platforms, Inc. in the United States. The choice is optional and can be withdrawn here; the shop works with advertising off. Consent is the stated basis, Art. 6(1)(a) GDPR. Advertising eligibility and Meta's separate terms still apply.
Advertising pixel is currently: Off
| Cookie | Purpose | Duration |
|---|---|---|
ob_ads | Your separate advertising choice | 180 days |
_fbp, _fbc | Meta browser/click identifiers after advertising consent | Up to 90 days |
Essential and requested browser preferences
The adult-entry answer, local bag, currency, consent/objection choices and requested account/game state support the functions you use. Some service information, such as bag contents at ordering, is transmitted when needed for that service; it is inaccurate to say everything in browser storage never reaches us.
| Key | Purpose | Duration |
|---|---|---|
onyx-bunny-age-confirmed | Your explicit adult attestation, not identity verification | Until site data is cleared |
ob-cart | Local bag contents | Until cleared or ordered |
ob-currency | EUR/USD display preference | Until changed or cleared |
ob-cookie-notice-dismissed | Notice preference | Until cleared |
ob-recently-viewed | Recent-product convenience | Last six items |
ob-promo-seen, ob-promo-signed-up | Requested signup offer state; phone signup opens only on request | Until cleared |
ob-orders | Local order references | Until cleared |
ob-private-profile:… | Encrypted optional local account data | Until sign-out or clearing |
| Game settings/progress | Requested game functions | Until cleared |
Clearing storage and contacting us
Browser site-data settings can remove stored preferences, your local account data and game progress. Clearing storage also removes consent and counting-objection preferences. Private browsing may discard them when closed.
No session recording, fingerprinting, Google Analytics or TikTok pixel is used. Contact hello@onyxbunny.com about these choices. See our privacy policy.