Two cookies are always set, because the shop cannot work without them. Two further groups — analytics and marketing — are set only if you switch them on, separately, and the shop behaves identically whether you do or not. Change your mind any time from the Cookie settings link in the footer.
1. Strictly necessary — always on
| Cookie | Purpose | Duration |
|---|---|---|
hokuracing_session_v2 |
Keeps your session: what is in your cart, whether you are signed in, and form state between pages. Without it the cart empties on every click. | 12 hours |
XSRF-TOKEN |
Security. Proves that a form submission came from this site and not from an attacker's page (cross-site request forgery protection). | 12 hours |
Both are first-party — set by hokuracing.com, readable only by hokuracing.com, and marked Secure, HttpOnly where applicable and SameSite=Lax. No consent is required for these, and switching them off is not possible without breaking the shop.
Your cookie choices themselves are remembered in your browser's local storage under hoku-consent-v2. That is what stops us asking again on every page.
2. Analytics — off unless you allow it
Google Analytics 4 (measurement ID G-829GX2FLT4) tells us how many people visit, which pages they read and where they arrived from. We use it to decide what to fix, not to identify anybody.
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Distinguishes one browser from another so repeat visits are not counted as new people | 2 years |
_ga_<container> | Holds the session state for this property | 2 years |
Google Ireland Limited acts as our processor for this, under Google's data processing terms. IP addresses are truncated before storage. We have not enabled Google Signals, advertising features, or data sharing with Google Ads.
3. Marketing — off unless you allow it
The Meta Pixel (ID 1284071063694224) lets us see whether our advertising on Facebook and Instagram actually leads anywhere, and lets us show ads to people who have looked at our wheels. It is a separate switch from analytics, because it is a different purpose: analytics is us counting, marketing is us advertising.
| Cookie | Purpose | Duration |
|---|---|---|
_fbp | Identifies the browser to Meta so ad interactions can be attributed to visits | 3 months |
_fbc | Set only if you arrived from a Meta ad; records which ad it was | 3 months |
Be aware of what this one means. Meta Platforms Ireland Limited is a controller in its own right for the data the pixel sends, not merely our processor, and that data may be transferred to Meta in the United States under the EU–US Data Privacy Framework. Meta may combine it with the profile it already holds if you have a Facebook or Instagram account. This is precisely why it is a separate, opt-in switch, and why declining it changes nothing about your ability to browse or buy.
4. What is not here at all
- No TikTok pixel, no Google Ads remarketing tag, no other advertising networks.
- No heatmaps or session recording.
- No cookie walls — you are never made to accept anything to read a page or place an order.
5. Nothing loads before you decide
Worth stating plainly, because most sites do it differently: while the banner is unanswered, or after you decline, the Google Analytics and Meta Pixel scripts are not downloaded at all. No request reaches Google or Meta, and no cookie is placed. Many sites load both immediately and merely withhold the cookies, which still hands your IP address to those companies. We do not.
We also leave out the <noscript> image that Meta's standard installation includes, because it would fire before anyone could consent.
6. Changing or withdrawing your choice
Use Cookie settings at the bottom of any page. Turning a switch off stops further collection immediately; to remove what was already gathered, write to info@hokuracing.com and we will ask Google or Meta to delete it.
You can also delete or block cookies in your browser settings. Blocking the two necessary cookies will break the cart and sign-in — not as a penalty, but because they are the mechanism that remembers what you added.
If you cleared cookies while a page was already open, reload the page before submitting a form. Otherwise the page holds a security token that no longer matches your new session, and the submission is rejected as expired.
7. Third parties your browser contacts regardless
- Google Fonts — our pages load typefaces from
fonts.googleapis.comandfonts.gstatic.com. No cookie is set, but your browser makes a request to Google and Google therefore sees your IP address. This happens whatever your cookie choices are. A content blocker prevents it and the site stays fully usable, only with fallback typefaces. - Payment providers — when you proceed to pay, you are taken to Stripe, Klarna or PayPal. Those pages are theirs and their own cookie notices apply there. Nothing of theirs loads inside our pages before you choose to pay.
- Social links in our footer are plain links. Nothing is loaded from Instagram, TikTok, Facebook or YouTube unless you click through.
8. Questions
Write to info@hokuracing.com. How we handle personal data more generally is set out in our Privacy Policy.