Cookie Policy

Last updated: 25 September 2026

Cookies are small files a website stores on your device. We use them, and a couple of similar technologies like browser storage, to keep Luma working, to understand how it’s used, and to measure our adverts. This page explains what we use them for, and lists each one with how long it lasts.

When you first visit Luma, we ask which optional cookies you’re happy for us to use. You can change your mind at any time: use the button below, or the “Cookie preferences” link in the footer of any page.

The categories

Necessary: required for the site to work (staying signed in, remembering your cookie choice, keeping forms secure). These can’t be turned off, and don’t need your consent.
Functional: things Luma holds onto while you’re using the site, like what’s in your basket and how far you’ve got in setting up a shop. Never shared with anyone else. There’s no separate switch for these: without them you’d lose whatever you were in the middle of, so they sit under Necessary.
Analytics: help us understand how Luma is used so we can improve it, and may record a replay of your visit. Optional, only if you agree.
Marketing: measure the performance of our adverts. Optional, only if you agree.

Cookies we use

Those four categories are the whole of it. The full list is here if you want to check a particular name, who it belongs to, or how long it lasts.

All 17 cookies and storage keys

Name	Category	Provider	Purpose	Duration
luma-market-auth.*Cookie	Necessary	Luma Market	Keeps you signed in securely.	Session / up to 30 days
luma-verify-*Cookie	Necessary	Luma Market	Carries your name and email from the sign-up form to the page that asks you to check your inbox, so it can tell you where we sent the link.	10 minutes
luma_cookie_consentCookie	Necessary	Luma Market	Remembers your cookie preferences.	365 days
luma_buy_nowCookie	Necessary	Luma Market	Lets checkout show the maker’s business name and address when you use Buy it now, which the law requires before you pay.	60 minutes
luma-known-deviceCookie	Necessary	Luma Market	Remembers that you’ve signed in on this browser before, so someone else guessing at your email address can’t keep you out of your own account. It holds no addresses, only a one-way digest of them.	180 days
__cf_bm / cf_* / _cfuvidCookie	Necessary	Cloudflare	Tells bots apart from people, so automated traffic can’t overwhelm the site or reach pages it shouldn’t. Our contact form is protected the same way.	Session to 30 minutes
__stripe_mid / __stripe_sidCookie	Necessary	Stripe	Set by our payment provider (Stripe), on its own domain, inside the panels where makers manage payments and payouts, to spot fraud and keep those payments secure.	30 minutes to 1 year
__stripe_orig_propsCookie	Functional	Stripe	Set by our payment provider (Stripe), on its own domain, inside the same panels. Stripe says it remembers the page you came from and the page you first landed on.	1 year
cartItemsBrowser storage	Functional	Luma Market	Remembers what’s in your basket between visits.	Until you clear it
luma.onboarding.*Browser storage	Functional	Luma Market	Keeps your shop-setup answers on this device while you work through the wizard, so a refresh loses nothing.	Until your shop opens, or you clear it
maker-orders-hide-completeBrowser storage	Functional	Luma Market	Remembers whether you’ve chosen to hide completed orders on your orders page.	Until you clear it
ph_*Cookie	Analytics	PostHog	Helps us understand how Luma is used so we can improve it, and may record a replay of your visit so we can see where the site gets in your way. Replays are switched off on your account pages, your messages and your order screens.	Up to 12 months
ph_* / __ph_*Browser storage	Analytics	PostHog	PostHog’s own copy of the visit identifier above, plus a record of your analytics choice, so a visit still holds together if the cookie is dropped.	Until you withdraw consent; the record of your choice itself stays
ph_*Browser storage (this tab)	Analytics	PostHog	Keeps the tab you’re browsing in tied to the rest of your visit, so a replay and the pages it covers stay together.	Until you close the tab
buy-now-item / cart-discount-* / cart-postage-upgrade-*Browser storage (this tab)	Functional	Luma Market	Carries what you’re buying, any discount code and any delivery upgrade from your basket through to checkout, so nothing is lost when you come back from paying.	Until you close the tab
maintenance-banner-dismissed-*Browser storage (this tab)	Functional	Luma Market	Remembers that you’ve closed a maintenance notice, so it doesn’t come back on every page.	Until you close the tab
_fbp / _fbcCookie	Marketing	Meta	Measures the performance of our adverts on Facebook/Instagram.	Up to 90 days

Changing your mind

Withdrawing consent is as easy as giving it. Reopen your preferences at any time from the “Cookie preferences” link in the footer, or the button above. Changes take effect immediately. Your choice is remembered for 365 days, and we’ll ask again if we make a material change to how we use cookies.

What this page doesn’t cover

Your choice here covers what happens on your device. Separately, we record a small set of transaction events on our own servers (an order being paid, a shop being created, a listing published). Those run under legitimate interests rather than this consent, and you can object to them. Section 3 of our Privacy Policy explains what they are and how to object.

For more on how we handle your data generally, see our Privacy Policy.