Cookie Policy

This is a draft, not a published policy

Read this first. This document is an unreviewed draft. It was written to give a solicitor a starting point, from a reading of the Encave software as it stands. It is not legal advice, it has not been checked by a qualified adviser, and it must not be relied on or published as it is.

Version [[POLICY_VERSION]]. Last updated [[LAST_UPDATED]].

Three things in particular are unfinished.

• Anything written in double square brackets is a detail nobody has supplied yet. There is a checklist of them at the end.
• The section headed "You cannot currently refuse non-essential cookies on this site" describes a real gap in the software, not a drafting choice. Whether that gap is closed in the software before launch, or disclosed on the live site as it stands, is a commercial and legal decision nobody has taken.
• This draft rests on a reading of the source code, not on observing the live site. The cookies the site actually sends have not been seen in a browser, and neither has the storage written inside the embedded Google map. Both have to be checked before anything here is published.

One sequencing point. This page cross-refers twice to a Privacy Policy that has not yet been written, and the site separately carries a plain-English privacy page at /data-and-privacy, reachable only from signed-in settings, which says nothing at all about browser storage. All three documents need to agree before any of them is published.

In short

Encave stores a small number of things in your browser. Almost all of them exist to keep you signed in, to keep the sign-in process safe, to remember which delivery address you have chosen, and to hold part-finished work while you fill it in.

Encave sets nothing for analytics, advertising or tracking. There is no Google Analytics, no advertising pixel, no session recording and no error-tracking tool in this site's code; no analytics or tracking code runs in your browser; and nothing here is designed to follow you between sites. We do not use device fingerprinting. What our own systems record about your activity once you are signed in is a separate question, and it is covered in our Privacy Policy rather than on this page.

There is one exception to the "essential only" position: an embedded Google map that appears when you bid on or buy a lot that is collected in person. Google may store things in your browser through that map, and that storage is not essential. At the moment the site has no way for you to refuse it. That is explained in full below.

Who we are

This policy is published by [[COMPANY_LEGAL_NAME]], [[LEGAL_FORM_AND_JURISDICTION]], registration number [[COMPANY_NUMBER]], whose registered office is at [[REGISTERED_ADDRESS]]. We trade as Encave and this policy covers the website at encave.app. Encave's buying and selling service operates in Great Britain mainland only.

How your personal information is used more generally is covered in our Privacy Policy. This policy covers only what is stored in your browser and read back out of it.

What cookies and similar technologies are

A cookie is a small text file that a website asks your browser to save. Your browser sends it back the next time you visit, so the site can recognise that this is the same browser as before. Cookies are how a website can keep you signed in from one page to the next, because without one every page would be a stranger.

A first-party cookie is set by the site you are actually on. A third-party cookie is set by someone else whose content the page has pulled in, such as an embedded map or video. Third-party cookies are the ones usually used for tracking people between sites.

Cookies have two other properties worth knowing about. A session cookie is thrown away when you close your browser. A persistent cookie has an expiry date and survives until then, or until you delete it. Some cookies are marked httpOnly, which means code running in the page cannot read them; this makes a stolen session much harder to pull off. All the cookies Encave sets itself are httpOnly.

There are also similar technologies that are not cookies but do a comparable job, and the law treats them the same way:

• sessionStorage holds information in one browser tab and discards it when you close that tab. Encave uses this for part-finished work. Unlike our cookies, sessionStorage is readable by code running in the page, so the httpOnly point above applies to the cookies only.
• localStorage holds information in your browser indefinitely. Encave does not use it at all.
• IndexedDB, service workers and cache storage are other ways a site can keep data or files in your browser. Encave uses none of them.

Throughout this policy, "storage" means all of these, not just cookies, because the rules are the same for all of them.

What "strictly necessary" means

UK law treats storage in your browser in two groups.

Some storage is exempt from the consent rule. There are two exemptions. The first covers storage or access for the sole purpose of carrying out the transmission of a communication — the plumbing that gets a page from our servers to you. The second, and the one most of the items below rely on, covers storage that is strictly necessary to provide a service you have specifically asked for.

Where an exemption applies, the cookie rules in PECR do not require us to ask your permission, and they do not impose a duty to tell you about those items either. The duty to describe them comes from data protection law and from the Information Commissioner's guidance on good practice, not from PECR. We set them out here anyway, because a reader should be able to see everything in one place.

Everything outside those exemptions needs your consent before it is set. Consent means a real choice: a clear positive action by you, freely given, and as easy to withdraw as it was to give. Silence is not consent, and carrying on using the site is not consent.

"Strictly necessary" is a narrow test. It does not mean useful, or commercially important, or convenient for us. It means the service you asked for cannot be delivered without it.

The Data (Use and Access) Act 2025 amends PECR, adding further exceptions to the consent rule — including storage used to adapt the appearance or function of a site at the user's request, and storage used for security and fraud prevention. Each of those exceptions is conditional on giving clear information and offering a way to object, so they are not a route to silence. Whether those provisions are in force, and whether any item below should rely on them, is a question for our advisers; the same Act raises the maximum penalties under PECR to the levels that apply under UK GDPR.

Everything Encave stores in your browser

This is the complete inventory as far as the software can be read. It covers cookies and the other storage described above.

Two caveats, both important. First, the software cannot tell us what Google stores inside the embedded map, so that row is incomplete. Second, our hosting platform may set cookies of its own on preview or access-protected deployments, which is invisible in our own code. Both have to be checked in a browser.

The last column is our own assessment, not a settled legal conclusion. Where it is marked for confirmation, the classification is the business's view pending advice.

Notes on the table

The Google map is the only third-party item in the table above, and the only non-essential one. The map appears inside the "collection only" confirmation dialog, which opens when you bid on or buy a lot the buyer collects in person. It does not load on the home page, the browse pages or an ordinary lot page. While it is open, your browser is talking to Google directly, which means Google receives your IP address, information about your browser, the blurred map coordinates, the full web address of the Encave page you are on — which identifies the particular lot you are bidding on or buying — and any Google cookies your browser already carries. The page address is sent because of a setting on the embed that we can and should change; doing so is a one-line fix and is on the list of open points.

We cannot list what Google stores, how long for, or why, because none of that is visible in our own software. That is not an answer: the law requires the information, and the placeholders in the Google row above mark exactly where it has to go. The frame has to be observed in a browser before this page is published, and if that is not done the embed should not ship.

The map is not strictly necessary: your bid or purchase would complete perfectly well without it. That matters, and it is dealt with in the section after next.

Google's own notice about the cookies it sets is at [[GOOGLE_COOKIE_NOTICE_URL]].

What the pre-sign-in upload identifier leaves behind. This is the item in this inventory most worth a careful read. The identifier from encave_guest_upload is written into the storage path of anything you upload before signing in. If you then create an account and publish that photo on a lot, the path becomes part of the photo's public web address — and listing photos are served publicly, with no sign-in check and with long-lived caching. So the identifier remains visible in that public address for as long as the lot's photo exists, which is longer than the seven days the cookie itself lasts. Files uploaded this way are also not deleted when an account is closed, and nothing currently clears uploads that were never published. It is better described as a pseudonymous identifier that outlives the cookie than as a browser-only one, and the retention of pre-sign-in uploads is on the list of open points.

The two Encave cookies with the longest lives are under review. encave_ship_to lasts a year, and encave_guest_upload gives a visitor who is not signed in a unique identifier for seven days. Neither is used to track you, profile you or advertise to you. But a stored preference that lasts a year is hard to describe as strictly necessary for a transaction that lasts minutes, and seven days is longer than a single upload needs. Both durations, and both classifications, are open points rather than settled positions, which is why the assessment column marks them for confirmation.

Where three of these names come from. The three Auth.js names, the __Secure- and __Host- prefixes and the 30-day session life are the sign-in library's own defaults — read out of the installed library, which is a pre-release version — rather than settings Encave has chosen. Upgrading that library, or adding a sign-in-with-Google option or support for a security key, would change this inventory, so the browser check should be re-run whenever it changes.

The collection postcode is stored in full. Only the postcode district is shown publicly on a lot, but the full postcode you type is held in the part-finished listing in your browser tab.

What is not stored. Encave does not use localStorage at all, so nothing is kept in your browser beyond the tab or the cookie lifetimes listed above. There is no IndexedDB use, no service worker, no cache storage and no app manifest. Your sign-in is held only in the httpOnly cookie listed above, so no sign-in token is readable by code in the page. We do not use device fingerprinting — that is, we do not build an identifier out of your device's characteristics.

Two other times your browser or our servers contact someone else. Neither stores anything in your browser, but both belong in a complete picture:

• When a seller uploads a video to a listing, the file goes straight from their browser to our storage provider rather than through our own servers. Nothing is set in the browser by it.
• When a lot is offered for collection in person, our servers — not your browser — send the seller's collection postcode to a third-party postcode lookup service to work out the approximate area before the map is blurred. Your browser is not involved and your IP address is not sent. This is the seller's information, not the visitor's, and it belongs in the Privacy Policy.

Request logging by our hosting platform. There is no analytics code on this site, but everything served to you passes through our hosting platform, which keeps its own request logs containing IP addresses, browser information and the addresses of pages requested. That is not storage in your browser, so it is not in the table — but it would be wrong to leave you with the impression that nothing anywhere records a visit. What is kept, and for how long, is covered in our Privacy Policy.

When you pay, you leave this site. No card form and no payment script runs on encave.app, so no payment provider sets anything in your browser while you are here. Where card payment is taken through [[PAYMENT_PROVIDER]], it happens on that provider's own pages rather than ours; seller payouts and identity checks are also handled on the provider's own pages. Any cookies set while you are on those pages are set by the provider on its own domains, under its own notices, and we neither control them nor see them.

Our fonts are not a third party. The typefaces this site uses are downloaded once when the site is built and are served from our own domain. Your browser never contacts Google to fetch a font, and no font provider sets anything in your browser.

Why we are allowed to do this

Describing what is stored is only half of it. Below is the basis we rely on for using the information that comes out of that storage. Each one is our own view pending advice.

• The sign-in cookies, the chosen-delivery-address cookie, the part-finished listing and the import prefill. We rely on performance of our contract with you, or on our legitimate interests in running the site securely and in not losing your work. Which of the two applies to each item is [[TO_CONFIRM]].
• The pre-sign-in upload identifier. We rely on our legitimate interests in keeping each visitor's uploads separate and in preventing abuse of the upload endpoint. [[TO_CONFIRM]]
• The embedded Google map. The basis is your consent, and nothing else. Where the cookie rules require consent before storage, consent is also the basis for the processing that follows; we cannot fall back on legitimate interests for it. We are not currently obtaining that consent, which is the subject of the next section.

Our Privacy Policy sets out the same bases in context, and the two documents must not disagree.

Information about transfers out of the UK. The Google map is the one place in this inventory where your information goes directly to someone else. The controller is [[GOOGLE_ENTITY]] — to be confirmed as Google Ireland Limited, Google LLC, or both. Information sent through that frame may be transferred to the United States. The safeguard we rely on for that transfer is [[GOOGLE_TRANSFER_MECHANISM]] — for example the UK Extension to the EU–US Data Privacy Framework, or an International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask for a copy of the relevant safeguards by emailing [[PRIVACY_EMAIL]]. The transfers section of our Privacy Policy covers this in full.

You cannot currently refuse non-essential cookies on this site

[[DECISION: close the gap in the software before launch and delete this section, or publish this disclosure as it stands — solicitor to advise]]

This is the most important thing on this page, so we will put it plainly.

Encave has no cookie banner and no cookie preference controls. There is nothing on the site that asks your permission before the embedded Google map loads, and nothing that lets you turn it off. If you open the collection-only confirmation step, the map loads and whatever Google stores is stored, whether you would have agreed to it or not.

The Privacy and Electronic Communications (EC Directive) Regulations 2003 — PECR — require two things for anything that is not exempt: clear and comprehensive information about what is stored and why, and your consent before it is stored or read. For the embedded Google map we currently satisfy neither. The map is not strictly necessary, so consent is required for it, and we are not obtaining it. We are telling you this rather than describing controls that do not exist.

Two related points, so that nothing here is misleading:

• The tick-box on the sign-up form — "I agree to the Terms of Service and Privacy Policy" — is acceptance of our terms. It is not consent to cookies or browser storage, it has never been presented as such, and it should not be read as such.
• Everything else in the table above is in the exempt group on our own assessment, so those items would not require consent in any event. The missing consent mechanism is not hiding tracking. There is no tracking to hide.

Because the map is the only non-essential item, the cheapest fix is not a banner at all: replace the embedded map with something that does not call Google until you ask it to, or serve a static map from our own domain. That removes the breach, removes the need for a consent mechanism, and makes the "essential only" position on this page true. If instead anything non-essential is kept, then a consent mechanism is needed, and it will have to record what you agreed to and when, let you withdraw consent as easily as you gave it, and ask again at sensible intervals — the Information Commissioner's guidance suggests revisiting consent roughly every six months. None of that exists today. When a control does exist, it will be at [[COOKIE_SETTINGS_URL]] and will be linked from this page.

What you can do in the meantime

Until there is a proper control on the site, you have three practical options.

• Avoid the map. It only ever loads inside the collection-only confirmation step. If you do not open that step, it does not load.
• Block third-party cookies in your browser. In most browsers this will stop the Google frame storing cookies, and it will not affect your use of Encave, because none of our own cookies are third-party. Be clear about what it does not do: it does not stop the frame loading, it does not stop Google receiving your IP address, your browser information and the page address the moment the frame loads whatever your cookie settings are, and it may not stop other kinds of storage inside the frame.
• Block or clear cookies for this site specifically. How to do that is in the next section. Be aware of the consequences, which are also set out there.

We are not asking you to accept this position. It needs fixing in the software, and it is recorded as an open point for our advisers alongside this draft.

How to control cookies in your browser

Your browser, not this website, is where cookies and storage are ultimately controlled. Every major browser lets you see what a site has stored, delete it, block cookies for one site or for all sites, block third-party cookies separately, and clear everything when you close the window.

The settings live in different places and the wording changes between versions, so rather than give instructions that will go stale:

• In Chrome, Edge and other Chromium-based browsers, look under Settings, then Privacy and security, then the cookies or site-data section. You can also click the icon at the left of the address bar on any page to see and clear what that site has stored.
• In Safari on a Mac, look under Settings, then Privacy. On an iPhone or iPad, look under the Settings app, then Safari.
• In Firefox, look under Settings, then Privacy & Security.

If you cannot find it, your browser's own help pages are the most reliable guide, and they are kept up to date in a way this page cannot be. Most browsers also offer a private or incognito window, which discards cookies and storage when you close it.

Separately, most browsers can send a "do not track" or similar signal. Encave does not respond to those signals in any particular way, because we set nothing for tracking that could be switched off.

What happens if you block the cookies we say are necessary

Blocking the cookies in the table above does not break the site quietly. It stops specific things working, and it is worth knowing which:

• You cannot stay signed in. Without the session cookie, every page treats you as a new visitor. You will not reach your account, your cellar or your orders, and you cannot bid, buy, list, sell or message anyone, because all of that requires a signed-in account.
• You cannot sign in at all. The security cookie that protects the sign-in form is a cookie too. Block it and the sign-in will be refused.
• Postage and totals may be worked out against the wrong address. Without the chosen-delivery-address cookie, the site quietly falls back to your default saved address instead of the one you picked, and will not prompt you to choose again.
• Uploads made before you sign in are no longer grouped together. They still work, and you still get the photo back; they simply land in separate folders rather than one.
• A part-finished listing will not survive a refresh, if sessionStorage is blocked.

Browsing the site and reading lots and wine pages will still work. Anything involving your account will not. We cannot provide an alternative for the sign-in cookies, because they are not optional extras on top of the service — they are how signing in works.

Changes to this policy

The version number and date at the top of this page tell you which version you are reading and when it last changed. We keep a short record of changes to this inventory at [[CHANGE_LOG_LOCATION]]. If we change what we store in your browser, we will update this page.

If we ever introduce anything that is not strictly necessary — analytics, for example, or a new embed — we will put a consent mechanism in place first and ask you before it is set. [[COMMITMENT_TO_CONFIRM]] We will not treat your continued use of the site as agreement to new storage.

Where a change is significant, we will draw attention to it on the site rather than relying on you re-reading this page, and if we hold an email address for you we may use it to tell you. [[COMMITMENT_TO_CONFIRM]]

Questions, or a complaint

If you have a question about anything on this page, or you want to know what we hold about you, email us at [[PRIVACY_EMAIL]] or write to us at [[REGISTERED_ADDRESS]]. Our contact for data protection questions is [[DATA_PROTECTION_CONTACT]]. Our registration with the Information Commissioner's Office, where one is required, is [[ICO_REGISTRATION]].

If you are not satisfied with how we have handled it, you can complain to the Information Commissioner's Office, the UK regulator for data protection and for the cookie rules in PECR. The ICO asks that you give us the chance to put things right first, and we would prefer that too. The ICO's contact details are on its own website.

Details still to supply

Company and contact: [[COMPANY_LEGAL_NAME]], [[LEGAL_FORM_AND_JURISDICTION]], [[COMPANY_NUMBER]], [[REGISTERED_ADDRESS]], encave.app, [[PRIVACY_EMAIL]], [[DATA_PROTECTION_CONTACT]], [[ICO_REGISTRATION]].

Document: [[POLICY_VERSION]], [[LAST_UPDATED]], [[CHANGE_LOG_LOCATION]].

Still to be observed in a browser or confirmed with a provider: [[GOOGLE_COOKIE_NAMES]], [[GOOGLE_COOKIE_PURPOSES]], [[GOOGLE_COOKIE_DURATIONS]], [[GOOGLE_ENTITY]], [[GOOGLE_TRANSFER_MECHANISM]], [[GOOGLE_COOKIE_NOTICE_URL]], [[HOSTING_PLATFORM_COOKIES]], [[PAYMENT_PROVIDER]].

Still to be built: [[AGE_AFFIRMATION_STORAGE]], [[COOKIE_SETTINGS_URL]].