Cookie Policy

The short version

Essential cookies run the store — sign-in, cart, checkout, and bot protection. They are always on, because the site cannot work without them. Analytics cookies are optional: they run only if you accept them in the cookie banner, and you can change your mind any time with the “Cookie settings” link in the footer. We run no advertising or cross-site tracking cookies at all.

Essential cookies (always on)

• Session cookie — keeps you signed in for 7 days, or 30 days if you choose “remember me” at sign-in or you sign in with Google.
• Google sign-in cookies (kf_google_state, kf_google_verifier) — two short-lived cookies (10 minutes) that keep the optional “Sign in with Google” flow secure. They are set only when you start that sign-in and are cleared when it finishes.
• Age confirmation cookie (kf_age_attest) — a short-lived cookie (10 minutes) set only when you tick the 18-or-older box on the signup page and start “Sign up with Google.” It holds no birthdate — just the value “1” — and is deleted as soon as the Google sign-in finishes.
• Checkout confirmation cookie — a short-lived cookie that ties a payment to the order it belongs to during checkout.
• Currency cookie (kf_currency) — remembers the display currency you picked; lasts up to a year.
• Referral cookie — if you arrive through a member's referral link, a cookie remembers which member sent you so they get credit if you join.
• Cloudflare Turnstile — our signup, newsletter, and other forms use Turnstile bot checks, which may set their own cookies on challenges.cloudflare.com to tell humans from bots.
• Site management cookie (kf_edit) — set only for the shop's own staff when they sign in to edit the site. Customers never receive it.
• Live-show viewer count — on a live-show page, a random viewer id kept in your browser's local storage (kf-live-viewer) is used to count who is watching. If you are signed in, you are counted as part of running the show; if you are not signed in, you are counted only if you have accepted analytics cookies. The attendance records are deleted when the show ends — only the show's peak viewer count is kept.

Analytics cookies (only with your consent)

• Google Analytics (cookies beginning _ga) — counts visits and shows us which pages and products get attention. Set only after you accept analytics cookies.
• Visitor id (kf_vid) — a random id in an httpOnly cookie used by our own browsing heartbeat so we can see which pages are being viewed while they are being viewed. No IP address is stored. The cookie itself can persist for up to a year, but for browsing it is only ever read or used while analytics cookies are accepted, and the browsing records it keys are deleted after 24 hours of inactivity. If you are signed in, the heartbeat record is linked to your account email. Live-show viewer counting uses a different id, kept in your browser's local storage — see the essential cookies list above.

Browser storage that is not tracking

Your cart is kept in your browser's local storage so it survives a page refresh; it leaves your device only when you check out, or when our heartbeat (with your consent) reports what is in it. The books you view are also remembered in local storage — the last 12 — so the site can show you a recently viewed row; that list never leaves your device. If you start a CGC grading or signing request, its ID is kept in local storage so checkout can pick it up. A session-only flag also remembers that you have seen the intro splash, so it does not replay on every page; it disappears when you close the tab. Your wishlist is different: it is saved to your account on our server, so it follows you between devices. Your cookie choice itself is remembered in local storage so we do not ask you on every visit.

How to control cookies

Use the “Cookie settings” link in the footer to accept analytics cookies or switch back to essential-only at any time. You can also block or delete cookies in your browser settings; blocking essential cookies will break sign-in and checkout. If you decline analytics, Google Analytics never loads and the browsing heartbeat never sends. If you switch back to essential-only after accepting, analytics and the heartbeat stop, and the Google Analytics cookies already set are expired; the visitor-id cookie is never read again and expires on its own within a year.

Contact

Cookie questions may be sent through our contact form.