Cookie policy
Last updated 15 September 2026 · New Zealand
There are two kinds of cookie on this site. The first kind makes it work: remembering which country's store you chose, keeping you signed in, taking the payment, and telling real visitors from bots. Those are set whatever you decide, because without them the site can't do the thing you came for. You can block them in your browser, and then parts of the site won't work.
The second kind is advertising, and it only happens if you say yes. We advertise on Google and we want to know which adverts actually bring customers, so with your permission Google's tag measure the advert you clicked and the order you placed. The same permission lets Google Analytics count how many people visit, which pages they arrive on and which country they are in, so we can see what people are actually looking for. It tells us about visits, never about you by name — we do not upload your email address or anything else that identifies you to Google. Google's advertising and analytics tag is on every page, but before it loads we set all four of its consent settings to denied, so until you accept it stores nothing on your device and reads nothing from it. It still sends Google a signal that a page was viewed, with no identifier for you, and your IP address reaches Google the way it reaches any site your browser loads something from. Refusing changes nothing about the service: you can still find a number, verify your mobile, pay and use your control panel exactly as anyone else does.
How to change your mind. Every page has "Cookie settings" in the footer. It opens the same two buttons — Refuse and Accept — and whichever you press takes effect straight away; refusing is one click, exactly like accepting. Refusing after you accepted stops anything further being set or read and deletes the advertising items this site can reach — Google's own cookies on our domain, and our record of which orders were reported. The rest are set by Google on their own websites, which no page of ours can touch: clear those in your browser's settings. Your answer is kept in your own browser under lfm_consent; it is never sent to us and never sent to Google.
Stripe (payments), Clerk (sign-in), Cloudflare (who host the site) and Google (advertising) set their own, under their own policies — Stripe's on its own checkout page rather than on ours. Here is every cookie and every stored item we know of, who sets it, what it does, how long it lasts and whether it needs your permission:
| Cookie | Set by | What it does | How long it lasts | Does it need your consent? |
|---|---|---|---|---|
| lfm_store | Us | Remembers which country's store you chose, so we stop sending you somewhere else. | 1 year | No — the site needs it |
| lfm_aff | Us | Set only if you arrived through a partner's link. Records which partner introduced you, so they are paid for it. | 30 days | No — it completes the introduction you arrived through |
| lfm:selection | Us — kept in the browser tab you are in, not a cookie | Remembers the number you picked while you go through checkout. | Until you close the tab | No — checkout needs it |
| lfm:promo | Us — kept in the browser tab you are in, not a cookie | Remembers the offer code you asked for on an offer page, so checkout can apply it. | Until you close the tab | No — checkout needs it to give you the discount |
| lfm_consent | Us — kept in your browser, not a cookie | Remembers whether you accepted or refused advertising cookies, so we stop asking. | Until you clear this site's data in your browser | No — it is the record of this choice |
| __session, __client_uat, __clerk_environment and other __clerk items | Clerk, our sign-in provider | Keeps you signed in to your control panel and stops anyone else using your session. | From the end of the session up to 1 year | No — sign-in needs them |
| __stripe_mid, __stripe_sid | Stripe, our payment processor — set on Stripe's own checkout page, not on ours | Takes the payment and spots card fraud. | __stripe_sid 30 minutes, __stripe_mid 1 year | No — checkout needs them |
| __cf_bm | Cloudflare, who host the site | Set on requests Cloudflare screens, to tell real visitors from bots so the site stays up and the forms are not abused. | 30 minutes | No — it protects the site |
| _gcl_au, _gcl_aw, _gcl_ls | Records that you came from one of our Google adverts and links it to an order, so we know which adverts bring customers. | 90 days | Yes — set only after you accept, and deleted if you then refuse | |
| lfm_conv_… (one per order) | Us — kept in your browser, not a cookie | Marks an order as already reported to Google, so one purchase is not counted as two. | Until you refuse, or clear this site's data | Yes — written only after you accept, and deleted if you then refuse |
| NID, IDE, test_cookie and similar, on google.com and doubleclick.net | Measures the advert you clicked and can let Google show you our adverts on other sites. | From 15 minutes to about 13 months, under Google's own policies | Yes — set only after you accept | |
| _ga | Google Analytics | Tells our visitors apart, so we can count how many people came and which pages they arrived on. | 2 years | Yes — set only after you accept, and deleted if you then refuse |
| _ga_7DFG3N1FFX | Google Analytics | Keeps track of a single visit, so several pages read as one person looking around rather than as several people. | 2 years | Yes — set only after you accept, and deleted if you then refuse |