Cookies and Storage

Every cookie and every piece of storage this platform uses is listed at /trackers, with what it is for, how long it lasts, and whether it needs your permission. That page is generated from the same registry the software itself consults before writing anything, so it cannot describe something other than what runs.

This notice explains the shape of it. The list is the list.

We do not put a second copy of the list here, because two copies of a list are two lists, and the one that goes stale is always the one on the legal page.

No analytics. No tag manager. No advertising pixel. No session recording. No third-party origin. We do not profile you across websites and we have nothing to sell to anybody who would.

Everything the public site stores is there because the thing you asked for does not work without it — your basket, your sign-in, the address you picked. None of it needs your permission and we do not pretend to ask for it. That is why you have not been shown a consent banner: not because we decided you would not want one, but because there is no question to put to you.

This is enforced rather than asserted. Our build fails if any code stores something on your device that is not in the published register, and registering something that needs permission switches the banner on with the Greek rules already implemented. So the day this paragraph stops being true is the day it stops being published.

Our network can tell us which country a request came from. We use that to decide which language to OFFER you, and we do not keep it. It is read from the request, used to write the offer, and gone — nothing about your location is stored on your device or against you.

That was not always true. For one day this platform copied the country into a cookie that lasted twelve hours, so the language bar could be written in the offered language on the first paint. It was the only thing we put on a visitor's device before they had touched anything, and we removed it rather than argue that it was necessary. Reading a value we already have is not worse than storing it, and it is the version we can defend without a paragraph.

If you choose a language, or dismiss the offer, that choice is remembered on your device — because it is your choice, and remembering a choice you made is a different thing from recording a guess about you.

If you sign in, our server sets a session cookie that your browser will not let any script read. It exists to keep you signed in and for nothing else. Without it you would have to sign in again on every page, so it is strictly necessary and needs no consent.

The law here is about storing anything on your device, not only about cookies, so this list is complete rather than convenient.

Kept until you clear it: your light or dark theme choice; your language choice; a marker that you are signed in; and, if you have joined a group order, your seat in it.

Kept only until you close the tab: your basket; the delivery point you picked; and, if a card payment is part-way through a security challenge, enough to resume it. Your basket deliberately does not survive a week — a basket restored days later fails at checkout on sold-out dishes and a closed kitchen, and you would rightly blame us for wasting your time.

None of it is an identifier for advertising. None of it leaves your device except where it is needed to serve the request you made.

The card payment step is provided by Adyen and runs code that connects to Adyen's own servers. It is loaded from our application rather than from a third-party script tag, and it is there so your card details go to a payment processor rather than to us. It is strictly necessary to take a payment you asked us to take.

The screen that shows you where your order is draws a diagram, not a map. We deliberately do not embed a mapping service there, because requesting a map tile tells the map provider which coordinates are being looked at, and on a delivery screen those coordinates are your home address.

Elsewhere on the platform — on screens restaurants use rather than customers — a mapping service may be embedded. Where it is, it needs your permission first and it is listed at /trackers like everything else.

Where we ever do ask your permission for something, you can change your answer at any time from the same place you gave it, and withdrawing is as easy as granting was and lasts as long. Saying no is not made slower, uglier or more repetitive than saying yes.

You can clear everything from your browser settings at any time. Doing so signs you out and forgets your language and theme. It does not delete anything from your account — the Privacy Notice covers that, and those controls are in your account rather than in your browser.