Cookies & device storage

Form security

Active forms use the essential __Host-2box-forms cookie for secure submissions, lasting up to two hours. Authorised internal management sign-in uses __Host-2box-office for up to eight hours. Neither is used for advertising or cross-site tracking.

Boxy

Boxy uses sessionStorage for its position and invitations in the same tab. Its idle invitation appears at most once per session. Dismissing it stops further automatic invitations in that session. Conversations and personal details are not stored.

QR menus

The new TeaBox and JuiceBox menus carry the language in the page address and do not need preference storage on your device. The older cocktails-qr-menu and recipes-qr-menu pages use localStorage for language and drink filters. These entries remain until you clear them and contain no name, email or advertising identifier.

Lovable hosting statistics

The published site uses Lovable Visitor analytics for aggregate traffic: visits, page views, sources, countries and device types. Counting starts after publication. According to the provider’s documentation, it does not build individual visitor profiles or follow visitors across separate visits. These statistics are separate from optional Google and Meta measurement.

Optional Google and Meta measurement

Google Analytics and Meta Pixel/CAPI operate only at the official public address, when enabled and after you select the relevant category. Statistics and advertising measurement are separate, unchecked choices. Refusing does not prevent browsing or form use.

Google Analytics measures selected public pages and actions. Meta may associate a visit or successful enquiry submission with an account using technical information such as IP address, browser and optional cookie identifiers. We do not send names, email addresses, phone numbers, form messages, Boxy chat text or private enquiry links to measurement services. An enquiry event does not mean a sale.

Your choice lasts up to 180 days and can be changed through Cookie settings in the footer. Withdrawal stops subsequent measurement. When permitted, cookies _ga and _ga_* may be used for Google and _fbp/_fbc for Meta, in addition to the locally stored consent choice.