Cookie policy
Last updated: 11 October 2026.
This policy explains every cookie Pekkish sets, what it is for, and how long it lasts. It sits alongside our privacy policy, which covers personal data more broadly. Pekkish is operated by One Tandem Limited, a company registered in England and Wales (company number 17229064).
1. The short version
We set no advertising cookies, and nothing on a shop's storefront reports your browsing to Google, Meta, or any analytics company. On our own site, pekkish.co.uk, we use Google Analytics to see how the site is used, and HubSpot to see which of our emails to businesses bring people back — only if you accept, and never on a shop's pages. Every other cookie below is set by Pekkish itself, on the site you are looking at.
In the Pekkish app for iPhone, iPad and Android, we do not track you. The app sets only the cookies in sections 2.1 and 2.3, which keep you signed in, hold your basket and remember choices you made there. It sets none of the measurement cookies in section 2.2, loads no analytics or advertising code, and so never asks you about cookies.
2. Cookies we set
2.1 Strictly necessary
These make the site work. They cannot be switched off, and under the Privacy and Electronic Communications Regulations they do not require your consent.
| Name | Purpose | Lasts |
|---|---|---|
_lunch_mk2_session |
The page-to-page session for the site you are on. It holds your basket while you build an order, a referral code you arrived with, and the one-time codes used to sign in securely. If you arrived on a shop's storefront from an ad the shop paid for, it also notes which ad, for up to 7 days, so the shop can see how many people its ad brought and how many of them ordered. The shop only ever sees totals, never you, and pressing Decline on the cookie banner switches this off. Set on your first page view, because a basket has to live somewhere before you sign in. Signed and encrypted. | Until you close your browser |
session_id |
Keeps you signed in. Signed, so it cannot be tampered with; shared across Pekkish and every shop's subdomain so one account works at every shop you use. | Until you sign out, or 90 days after your last visit on that device (each visit extends it). Signing out, resetting your password, or "Sign out everywhere else" on your account page removes it. |
pk_consent |
Remembers whether you accepted or declined the measurement cookie below, so we stop asking. Set only once you answer. | 1 year |
pk_analytics |
Remembers whether you accepted or declined Google Analytics and HubSpot on pekkish.co.uk. Set only once you answer, and only on pekkish.co.uk. If we add a service you weren't asked about, we ask again. | 1 year |
mailshot_code |
If you arrive from the code on one of our postcards, remembers that code so the sign-up form can apply the offer printed on the card. Set only on that page, and removed once you sign up. Signed. | 30 days |
cross_host_flash |
Carries a one-line message, such as "Your shop is ready", from one Pekkish address to another: from pekkish.co.uk to a shop's own subdomain after you sign up, or to a shop's new address after it changes. Set only at that moment and deleted as soon as the message is shown. Signed. | 2 minutes at most |
2.2 Measurement — only with your consent
We ask before setting these, on shop storefronts and on pekkish.co.uk alike, and the site works normally if you decline. One answer covers every Pekkish site.
| Name | Purpose | Lasts |
|---|---|---|
pk_visitor |
A random identifier with no name, email or address attached. It lets us count how many people arrived from a particular link or campaign, so a shop can tell whether its poster or its social post actually brought anyone in. First-party only — never shared, sold, or readable by anyone else. | 1 year, refreshed on each visit |
pk_attribution |
Records which link first brought you here — the campaign or referral, never the pages you then look at. It is what lets a shop see that a nomination or a poster led to a real order. | 90 days |
2.2a Google Analytics — pekkish.co.uk only, with your consent
On our own marketing site (not on any shop's storefront, and not in the shop or account areas), and only after you accept, we load Google Analytics. Google sets these cookies to count visits and see which pages people use and how they found us. Google processes the data for us as our processor; we do not use it for advertising profiles.
| Name | Purpose | Lasts |
|---|---|---|
_ga |
A random identifier Google Analytics uses to tell visits apart. | 2 years |
_ga_<id> |
Keeps track of the current visit for Google Analytics. | 2 years |
2.2b HubSpot — pekkish.co.uk only, with your consent
We email some food businesses about Pekkish (see section 5a of our privacy policy). On our own marketing site only (not on any shop's storefront, and not in the shop or account areas), and only after you accept, we load HubSpot's tracking code so we can see which pages are visited and, if you arrived by clicking a link in one of those emails, that the visit came from it. HubSpot processes the data for us as our processor; we do not use it for advertising.
| Name | Purpose | Lasts |
|---|---|---|
hubspotutk |
A random identifier HubSpot uses to recognise a returning visitor, and to link visits to the email that brought them. | 6 months |
__hstc |
Records first, previous and current visit times and the number of visits. | 6 months |
__hssc |
Keeps track of the current visit. | 30 minutes |
__hssrc |
Tells HubSpot whether the browser has been restarted. | Until you close your browser |
2.3 Convenience
Small preferences, set as a result of something you did.
| Name | Purpose | Lasts |
|---|---|---|
passkey_device |
Remembers that this device has a passkey, so we offer Face ID or a fingerprint instead of asking for your password. It holds no credential — the passkey itself never leaves your device. | 20 years |
passkey_prompt_dismissed |
Remembers that you said no to setting up a passkey, so we stop offering. | 20 years |
beta_bar_dismissed |
Remembers that you closed the beta notice, so it stays closed. | 90 days |
Shop staff using the admin area also get one piece of session storage (not a cookie), shop-sidebar-scroll, which remembers where the sidebar was scrolled to between pages. It lasts until the tab is closed.
3. Changing your mind
Clear cookies for this site in your browser settings and the banner will ask again. Declining leaves the strictly necessary cookies in place — the site cannot function without them, and they are not used to track you.
4. What we do not do
- No advertising or retargeting cookies, and no advertising pixels.
- No third-party analytics on any shop's storefront, and none on pekkish.co.uk unless you accept Google Analytics. No Meta Pixel, no session recording.
- No selling or sharing of anything a cookie records.
- No cross-site tracking. A cookie set on one shop's storefront is not readable by another company.
5. Asking us about it
Questions about this policy, or about the data behind it, go to our contact form. One Tandem Limited is registered with the Information Commissioner's Office under registration number ZC156390.