Cookie Policy
Last updated: September 25, 2026
To Carry Wonder operates this website. This policy lists every cookie and third-party script that can load here, what each one does, and how to allow or refuse each category.
Your current choice
You can review or change your decision at any time. Refusing is exactly as easy as accepting.
What can load on this site
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| tcw_consent_v1 | To Carry Wonder | Strictly necessary | Stores your cookie choices so we do not ask again. | 12 months (local storage) |
| tcw_consent_subject | To Carry Wonder | Strictly necessary | A random, non-identifying id so repeat decisions by the same browser can be tied together in the consent log. Not used for tracking, never shared. | Until cleared (local storage) |
| _ga, _ga_0NJ49JYGPX | Google Analytics (Google Ireland Ltd.) | Analytics | Distinguishes visitors and sessions to produce aggregate usage reports. | Up to 24 months |
| None (cookieless) | Plausible Analytics | Analytics | Privacy-friendly page-view counts. Sets no cookie, but is still gated behind your consent. | Not applicable |
| mcforms-* , Mailchimp scripts | Mailchimp (Intuit Inc.) | Marketing | Newsletter sign-up pop-up and form tracking. Loads only after you allow Marketing cookies. Submitting a form yourself always works. | Session |
| Vimeo player (__cf_bm) | Vimeo.com, Inc. | Functional | Plays embedded videos, with Vimeo’s “do not track” mode on. Loads only after you allow Functional cookies. | 30 minutes |
| Cloudflare Turnstile | Cloudflare, Inc. | Strictly necessary | Spam protection on forms. Confined to pages with a form and sets no tracking cookies. | Session |
Server-side consent log
When you make a cookie choice, the banner records your decision server-side as evidence of consent (GDPR Art. 5(2) and 7(1)). This is strictly necessary: it fires only when a choice is made, sets no cookies, and stores the consent record itself. The record includes the date and time, an anonymous random visitor id, your choices, the method used (accept all, decline all, or preferences), the banner version, and a salted one-way hash of your IP — never the raw IP.
The four categories
- Strictly necessary — needed to deliver the site and to remember your cookie choice. Exempt from consent, cannot be disabled.
- Functional — third-party resources that improve the experience, such as embedded videos.
- Analytics — aggregate measurement of how the site is used. No analytics request is sent until you allow this.
- Marketing — advertising and remarketing tags. On this site that means the Mailchimp newsletter pop-up.
Browser controls
You can also block or delete cookies in your browser settings, and send a Global Privacy Control signal, which we honour as an opt-out of sale and sharing. Blocking strictly necessary storage may stop parts of the site working.