Cookie Policy

Last updated: September 12, 2026

This Cookie Policy explains which cookies and similar technologies YummyPenny, LLC ("YummyPenny", "we", "us", or "our") uses on yummypenny.com and in the member area, what each one is for, how long it lasts, and the choices you have. It is part of our Privacy Policy, which describes everything else we do with personal information.

1. What cookies and similar technologies are

A cookie is a small text file that a website asks your browser to store. Similar technologies include browser local storage, session storage, pixels and tags. They let a site remember that you are logged in, remember a preference such as a dark theme, keep a payment session secure, and measure how visitors reach a public page.

2. The cookies and storage we set ourselves

Name	Type	Purpose	Duration
`session`	Strictly necessary cookie	Keeps you logged in and carries the login state the member area needs. It is cryptographically signed, marked HttpOnly and SameSite, and sent only over HTTPS in production.	Seven days, extended each time you use the site. Deleted when you log out.
`yp-theme`	Functional (browser local storage, not a cookie)	Remembers whether you chose the light or dark theme so the page never flashes the wrong one.	Until you clear your browser storage or choose the other theme.
Terminal preferences	Functional (browser local storage)	Remembers small choices in the terminal, such as a dismissed tutorial or a collapsed panel, on the device you made them on. Your desks themselves are saved to your account, not to the browser.	Until you clear your browser storage.
`yp_analytics`	Functional cookie (your analytics choice)	Remembers which button you pressed on the cookie banner, so we do not ask again and so the analytics tag can be switched off before it loads. It holds one word, `on` or `off`, is marked HttpOnly so no script can read it, and is set only after you choose.	One year, or until you clear your cookies.
`yp_termbar`	Functional cookie (a dismissed banner)	Remembers that you closed the terminal strip at the top of the member pages, so it stays closed. It holds the single character `1` and is marked HttpOnly.	One year, or until you clear your cookies.
`yp_seen_at`	Functional cookie (when you last looked)	Remembers roughly when you last opened the deals page, so the “New to you” filter can show you what has arrived since. It holds one number, the time of that visit, and nothing about what you looked at. It is marked HttpOnly, so no script can read it, and it only moves forward when you come back after a break rather than on every page you open.	One year, or until you clear your cookies.

We set five things of our own and no more: the sign-in session, your theme, your analytics choice, whether you closed the terminal strip, and when you last looked at the deals page. Only the first is required for the site to work. You can delete it at any time through your browser, which logs you out.

The cookie banner. On our public pages, signed out, we ask once whether analytics may run, and section 5 describes both answers. It does not appear in the member area, because analytics never loads there; it does not appear if your browser sends Global Privacy Control, because that is already an answer; and it does not appear again once you have chosen.

3. Cookies set by services we use

Google Analytics 4 (public pages only)

We use Google Analytics 4 to understand how visitors find and move around our public pages. It sets cookies whose names begin with _ga (for example _ga and _ga_<id>). Google controls their duration, which can be up to two years.

We do not run analytics inside the member area. If you are logged in, no analytics tag loads and no analytics cookie is set on any page you see. Analytics runs only for visitors who are not signed in, on our public pages, because the only question we use it to answer is how people first find us.

We limit what is sent. Before a page view is reported we rebuild the web address so that only the page path and a short list of campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid) are included. Anything else in the address, including anything typed into a search box and any token contained in a link we email you, is removed and never reaches Google.

We honour Global Privacy Control. If your browser sends the Global Privacy Control signal, the analytics tag does not load at all and no analytics cookie is set, whether or not you are logged in.

Google Signals is switched off, and Google Analytics is not linked to Google Ads, so nothing here builds or targets advertising audiences and analytics stays a measurement tool. Two opt-outs work regardless: turn on Global Privacy Control and no analytics loads for your browser at all, or sign in, because analytics never loads for a signed-in member. You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites and opt out in any browser with Google's opt-out add-on. Blocking analytics does not affect your access to any part of the service.

Stripe (checkout and billing portal)

Payments and subscription management happen on pages hosted by Stripe. Stripe may set cookies there for payment processing, fraud prevention and authentication, such as __stripe_mid and __stripe_sid. Stripe controls their purpose and duration under Stripe's privacy policy. We never see or store your full card number.

Google Maps (pages with a store map)

Some pages show nearby stores on a Google Map. When a map loads, Google may set cookies and process map interactions, your approximate location or ZIP code, IP address and device information under Google's privacy policy and the Google Maps terms. The map loads only on pages that show one. The terminal's map uses map tiles we host ourselves and sets no Google cookie.

Discord

Our members-only community runs on Discord. Cookies set by Discord on discord.com are governed by Discord's privacy policy. We set no Discord cookie on our own pages.

4. What we do not use

We do not use advertising, retargeting or cross-context behavioural advertising cookies, we do not run advertising on this site, and we do not sell or share personal information for those purposes. If that ever changes we will update this policy first and provide any choice the law requires, including an opt-out.

5. Your choices

The banner on our public pages. The first time you visit a page while signed out, we ask. Essential only turns analytics off for a year, on every page, and no analytics cookie is set. Accept analytics leaves it on. Until you answer, analytics runs; we do not sell or share anything it collects, and the two opt-outs below work whether or not you have answered. You will not see the banner inside the member area, because analytics never loads there.
Browser settings. Every browser lets you view, block and delete cookies. Blocking the session cookie logs you out and prevents checkout and the member area from working.
Global Privacy Control. Turn it on in a supporting browser or extension and analytics will not load for you.
Log in. Logged-in members never receive the analytics tag.
Google's opt-out add-on at tools.google.com/dlpage/gaoptout blocks Google Analytics on every site.
Theme. The theme toggle in the header rewrites yp-theme; clearing site data removes it.
“New to you”. There is no switch for yp_seen_at, because it only ever holds the time of your last visit and nothing else. Clearing your cookies resets it, and the “New to you” filter then simply has nothing to compare against until your next visit.

6. Changes to this policy

If we add a cookie or a service that sets one, we will update this page and its date before the change goes live, and where the law requires it we will ask for your consent first. The banner described in section 5 is how we ask.

7. Contact

Questions about cookies or privacy: [email protected].

YummyPenny, LLC
Tyler Grove
2502 Leon St. Unit 307
Austin, TX 78705
Email: [email protected]