The short version
We use only strictly necessary cookies and browser storage: one security cookie, an encrypted sign-in session, your language/currency/theme choices and a service worker for the installable app. No analytics, no advertising, no social-media trackers, no fingerprinting. Because none of it is optional under privacy law, we do not show a consent banner; if we ever add optional cookies we will ask for your consent first.
1. What cookies and similar technologies are
Cookies are small text files a website stores in your browser. “Similar technologies” include browser local storage, session storage, IndexedDB, service workers and real-time connections. Laws such as the EU ePrivacy Directive, the UK PECR, the CCPA/CPRA, Brazil's LGPD, South Africa's POPIA and Nigeria's NDPA treat information stored in your device in broadly the same way, whichever technology is used, so this policy covers all of them.
2. First-party cookies and storage we set
| Name | Type | Purpose | Lifetime | Category |
|---|---|---|---|---|
.AspNetCore.Antiforgery.* |
Cookie (HTTP-only, secure, SameSite) | Protects forms and the real-time connection against cross-site request forgery. Contains a random token, no personal data. | Session (deleted when the browser closes) | Strictly necessary |
adf-buyer |
Local storage (encrypted by the server's data-protection keys) | Keeps you signed in between visits: holds your name, email and an opaque sign-in token that expires automatically. The token is stored on our side only as a hash. Cleared when you sign out. | Until sign-out; the token inside expires after 30 days | Strictly necessary (only set if you sign in) |
adf-locale |
Local storage | Remembers the language and display currency you chose so the site opens in them next time. Format: language code and currency code. | Until you clear browser data | Strictly necessary (user-requested preference) |
adf-theme |
Local storage | Remembers whether you chose light or dark mode, and applies it before the page paints. | Until you clear browser data | Strictly necessary (user-requested preference) |
Service worker (sw.js) |
Service worker registration | Lets the site be installed to your home screen as an app. It is “network-only”: it stores no pages, data or identifiers and does not work offline. | Until you uninstall the app or clear site data | Strictly necessary |
| Real-time connection | WebSocket (SignalR circuit) | The interactive parts of the site (basket, checkout, dashboards) run over a live connection to our server. Your basket and wishlist live in server memory for that connection only and are not written to your device or to our database until you place an order. | While the tab is open | Strictly necessary |
| Hosting affinity cookie (if present) | Cookie set by the hosting platform | Our host (Microsoft Azure Container Apps) may set a load-balancer cookie so that your live connection stays with the same server. It contains no personal data. | Session | Strictly necessary |
3. Third-party cookies and requests
| Provider | What happens | Where to learn more |
|---|---|---|
| Stripe (checkout.stripe.com) | When you pay, you are taken to Stripe's hosted checkout page. On that page Stripe sets its own cookies (for example __stripe_mid and __stripe_sid) for fraud prevention and to complete the payment. These are set on Stripe's domain, not ours, and are not loaded on our pages. |
Stripe's cookie and privacy policies at stripe.com/privacy |
| Google Fonts (fonts.googleapis.com, fonts.gstatic.com) | Your browser downloads the Inter and Poppins typefaces from Google. Google receives your IP address and browser details for that request. Google states it does not set cookies for Google Fonts and does not use the requests for advertising. We are evaluating self-hosting the fonts to remove this request entirely. | developers.google.com/fonts/faq/privacy |
| Email and SMS links | Links in our emails and texts point straight to our site; we do not use tracking pixels or click-tracking redirects. | See the Privacy Policy |
Our Content-Security-Policy technically prevents any other third-party script from running on our pages, which is how we can be confident that the list above is complete.
4. What we do not use
- No analytics or measurement cookies (no Google Analytics, Meta Pixel, Hotjar or similar). Our admin statistics are computed from order records, not from tracking visitors.
- No advertising, retargeting or affiliate cookies, and no “sale” or “sharing” of data as US state laws define those terms.
- No social-media plug-ins or embedded players that set cookies.
- No browser fingerprinting, cross-site tracking or location tracking. Our Permissions-Policy header disables camera, microphone and geolocation access for the whole site.
- No A/B testing or personalisation cookies.
5. Consent
Under the ePrivacy Directive (Article 5(3)) and equivalent laws, storage that is strictly necessary to provide a service you explicitly requested does not require consent. Everything listed above is in that category: the security cookie and live connection are needed for the site to work, the sign-in storage exists only because you signed in, and the language, currency and theme entries record choices you made. That is why you do not see a cookie banner. If we introduce any non-essential cookie in future we will add a consent mechanism that lets you accept or refuse it, with refusal as easy as acceptance, before it is set.
6. How to control cookies and storage
- Sign out from your account page to remove the sign-in session from your browser.
- Change language, currency or theme from the selectors at the top of any page; the stored preference updates immediately.
- Clear site data in your browser settings (Chrome: Settings → Privacy and security → Site settings; Safari: Preferences → Privacy → Manage Website Data; Firefox: Settings → Privacy & Security → Cookies and Site Data; Edge: Settings → Cookies and site permissions). This removes every entry listed in section 2.
- Block cookies in your browser. The site will still let you browse, but you will not be able to sign in, keep a basket, or check out, because those features need the security cookie and live connection.
- Uninstall the app from your home screen to remove the service worker, or remove it from your browser's application settings.
- Global Privacy Control / Do Not Track: we have nothing to switch off, but we honour these signals for any future feature that would require an opt-out.
7. Changes
We review this list whenever we change the site. The effective date at the top shows when it was last updated. Material changes, for example adding an optional cookie, will be announced on the site before they take effect and will require your consent where the law demands it.
8. Contact
Questions about cookies or storage: privacy@africandiscountfoods.com. See also the Privacy Policy.