1. What cookies and local storage are
Cookies are small text records a website can place on your device. Local storage is a similar browser feature that can retain settings and structured data. This policy covers both technologies and related session storage used by the Platform.
2. What this Platform uses
Three cookies are set by the infrastructure this website runs on rather than by the Branch’s own code, and are listed here alongside the Branch’s own browser storage so the table describes everything a visitor’s device actually receives.
| Storage | Set by | Purpose | Duration |
|---|---|---|---|
| __cf_bm | Cloudflare | Bot management: separates automated traffic from human visitors so the site can be protected from abuse | 30 minutes |
| session-id | Lovable, the hosting platform | Groups the page views and page-speed measurements the hosting platform records in one sitting; see section 4 | 30 minutes |
| __dpl | The hosting platform | Records which released version of the site served the page, so pages and their assets stay consistent while a new version is going out | 24 hours |
| Authentication session | The Branch (via Supabase) | Keeps authorised administrators and officials signed in securely | Session-defined; until sign-out or expiry |
| fkfw.bag.v1 | The Branch | Remembers products added to the store bag | Until cleared or replaced |
| fkfw.saved.v1 | The Branch | Remembers saved store products | Until cleared or replaced |
| fkfw.seen.v1 | The Branch | Remembers recently viewed store products | Until cleared or replaced |
| fkfw.promo.v1 | The Branch | Remembers the applied store promotion | Until cleared or replaced |
| fkfw.sig.v1 | The Branch | Groups the pages opened in one sitting so a visit is counted once | Session storage; discarded when the tab closes |
| fkfw.geo.v1 | The Branch | Holds the two-letter country already resolved for this sitting, so it is not looked up again | Session storage; discarded when the tab closes |
The fkfw. store keys remain on your device and are not, by themselves, sent to the Branch. Their contents may become part of an order only when you choose to submit checkout details.
3. Strictly necessary storage
Authentication and security storage is necessary to provide restricted account functions and protect the Platform. Disabling it may prevent sign-in. Store preferences support functions you request and do not require an account.
The Cloudflare bot-management cookie (__cf_bm) and the release cookie (__dpl) are set by the infrastructure that serves this site. The first protects the Platform from automated abuse; the second keeps a page and its assets on the same released version. Neither is linked to an account and neither is used to build a profile of you.
4. How this site is measured
Two separate measurements run on this site. They are described separately here because they work differently and are operated by different parties.
The Branch’s own measurement. The Branch counts how its pages are used, so it can see which competitions, clubs and stories people are actually reading. It sets no cookies. Each page opened is recorded with the page address, the referring website’s domain, a device category, the browser and operating-system family, a two-letter country code, and whether the browser identifies itself as automated, such as a search crawler or a headless browser. That last point is worked out in your browser and only the yes or no answer is sent; the browser’s full identifying string is never stored. The country is resolved by this site’s own network edge, or from your browser’s timezone setting where the edge cannot determine it; no third-party geolocation service is contacted and no IP address is stored in the record. Pages opened in one sitting are grouped by a random reference held in browser session storage, listed in the table above as fkfw.sig.v1. It is not a cookie, is not linked to any account, cannot be used to recognise you on a later visit, and is discarded when you close the tab.
The hosting platform’s measurement. This site is built and hosted on Lovable, and the platform adds its own measurement script to every page. That script records page views and page-speed readings: how quickly the page became visible, how stable it was as it loaded, and how quickly it responded to a first interaction. It sets the session-id cookie listed above, a random reference that expires after thirty minutes and is not linked to any account. The readings are sent to an address on this domain, which the platform forwards to its analytics provider, Tinybird, acting as its processor. This is a third-party service: the Branch does not operate it and does not control its infrastructure.
Neither measurement is used for advertising, and neither follows you to other websites.
The Branch does not choose the platform measurement page by page; it is part of how the site is hosted. If it is removed from the Platform, this section will be updated to say so.
5. Advertising
The Platform does not set advertising cookies and does not use cookies to build advertising profiles. If optional advertising technology is introduced, this policy and any consent controls will be updated before that technology is used where consent is required.
6. Why no consent banner is shown
The Branch has considered whether the storage described above requires your prior consent under the Data Protection Act, 2019 and the regulations made under it, and has concluded that it does not. This section records that reasoning so the position is open to challenge rather than merely assumed.
- None of the storage above is advertising or profiling technology. Nothing on this site builds a profile of you, follows you to another website, or is shared with an advertising network or data broker.
- None of it can single you out or recognise you on a later visit. Every identifier listed is random, unlinked to any account, and expires within thirty minutes (or within twenty-four hours, in the case of the release cookie), and none survives long enough to connect two visits.
- The security and delivery cookies are necessary to provide the service you asked for. Bot management protects the Platform and the people using it; the release cookie is what stops a page loading a mismatched version of itself.
- The store keys exist only to carry out something you chose to do (add an item to a bag, save a product, apply a promotion) and are held on your device.
- The measurement is limited to counting and to page speed, at a level that cannot identify a person.
This is the Branch’s position, not a ruling. If you consider that consent should have been sought, write to info@fkfnairobiwest.ke, and you may also complain to the Office of the Data Protection Commissioner. If advertising, profiling or cross-site technology is ever introduced, consent will be sought before it is used.
7. Third-party content
YouTube, social networks, ticketing sites and other external services may set their own cookies after you open or interact with them. Those services control their storage and explain it in their own policies.
8. Your choices
- Use your browser settings to inspect, block or delete cookies and site data.
- Clear this site’s local storage to remove the saved bag, products, browsing list and promotion.
- Block cookies for this site to refuse the bot-management, release and platform-measurement cookies. The site will still load, but protection against automated abuse is weakened.
- Sign out on shared devices to end an authenticated session.
- Blocking all storage may cause checkout preferences or restricted account functions to stop working.
9. Changes and contact
We will update this policy if the storage used by the Platform changes. Questions about browser storage or privacy may be sent to info@fkfnairobiwest.ke.