Cookie policy

Last updated: 1 November 2026 · Pokin Pokin (Greater Vancouver)

This page explains how pokinpokin websites and web pages use cookies and similar technologies in your browser (including local storage and session storage). It is provided for transparency. It is not legal advice.

What we use and why

• Cookie notice preference (local storage). When you dismiss the short notice at the bottom of the site (your analytics choice), we save your choice in local storage (for example key pokin_cookie_consent_v1) so we do not show the same notice again until we update this policy and bump the stored version.
• Member session (HTTP-only cookie). When you log in on the Reserve (plush reservation) flow, our server may set a secure session cookie (for example member_session) so you stay signed in while using that service. It is HTTP-only (not readable by page scripts), sent over HTTPS, and used only to operate the reservation features you requested.
• Admin language preference (local storage). The admin workspace saves your selected Chinese or English interface language under pokin_admin_language. This is a functional preference and does not enable analytics.
• Admin sign-in (browser storage via Supabase). The Admin area uses Supabase Auth. After you sign in, the session may be held in local storage (or similar) by the Supabase client library so you stay signed in until you sign out or the session expires. This is limited to the admin pages you use.
• Voucher code (first-party cookie and local storage). On pages that offer a free-token voucher, we may store a short code in local storage and a small first-party cookie (for example pokinpokin_voucher) so your code can be shown again if you return within the stated period. This supports the promotion you interact with on the site.
• Security token (session storage). Some forms use a one-time token in session storage (for example to reduce forged submissions). It is cleared when the browser tab session ends.
• Cloudflare Turnstile (when enabled). On the Reserve login and on the Birthday booking form submission, we may load Cloudflare Turnstile to reduce automated abuse. Turnstile may set or read cookies as described in Cloudflare’s privacy policy. It is only used where the verification widget is shown.

Plush Merge game

When you play Plush Merge, the page keeps a random player ID (pp_player_id), your best score, your sound setting and any game vouchers you won in local storage on your device. For each round it sends us anonymous play data: that random ID, when the round started and how long you played, how many plushies you dropped, your score, the biggest plush you made, how the round ended, the link you came from and your device type (for example iPhone or Android). Your IP address is turned into a one-way hashed value before it is stored, and we use it only to count visitors and spot abuse. We delete this play data after 90 days.

If you claim a game reward, we store your first name, the last 4 digits of your phone number and a one-way hash of the full number (to enforce the limit of 2 rewards per phone number), together with the voucher code. This is not shared with anyone else.

Birthday booking and payments

The birthday booking form collects the information you submit and sends it to our servers for review. It does not use extra cookies beyond what is listed above (for example Turnstile when the widget is shown). Pack payment is handled in store unless we add a separate optional online checkout later; if we do, we will describe it here.

Optional site analytics

We measure site visits only after you choose “Allow site analytics”. We use a random ID in session storage, renewed after 30 minutes of inactivity and at the Vancouver day boundary. We record only approved page paths, broad source categories, store choices and route clicks. We do not send form contents, complete referrers or URL query strings to analytics. We respect Global Privacy Control and Do Not Track for this optional feature.

At our server, IP addresses are processed with a secret daily-changing HMAC key for daily deduplication. Raw IP addresses are not saved in the analytics tables. Hashes remain protected data; they do not identify an exact person. Session and deduplication detail is removed after 90 days, while daily numeric totals are retained. Successful birthday requests and first approvals also contribute to aggregate business counts, including when optional browsing analytics is declined; in that case their entry source is unknown.

Change site analytics preference

Third-party tracking

Apart from the first-party game and optional site statistics described above, this public site does not load third-party advertising or analytics trackers such as Google Analytics or social advertising pixels in the page scripts we ship. If that changes, we will update this policy and, where required, ask before loading non-essential trackers.

Managing or deleting data in your browser

You can remove cookies and site data for our site through your browser settings (for example “Clear browsing data” or per-site storage controls). Doing so may sign you out of the reservation or admin flows, clear the cookie notice preference, or clear a saved voucher code until you complete the steps again.

Contact

Questions: [email protected] · You can also reach us via Contact.