Your preferences stay yours.

A required PHP session cookie holds the crate, protects the forms and associates an order reference with the session. On HTTPS that cookie is Secure, HttpOnly, host-only and SameSite=Lax. A separate browser-readable session cookie remembers a dismissed welcome window.

The optional bottle-fit entry holds only the cylinder choice and daily water amount on this device. It is neither read nor written until you allow that preference. Choose essentials only to remove that entry; reopening Cookie choices lets you change the decision.

An order record stores the pieces, quantities, totals and delivery details you submit. The card controls have no submitted field names, so the order record does not contain a card number or security code. Mailing-list permission records the email and affirmative choice separately from cookie permission.