Legal
Cookie Notice
Last updated August 2026
This notice explains the cookies and similar technologies we use on hhfreshfish.com, and sits alongside our Privacy Policy.
Change your choices
No cookie outside the strictly necessary category is written unless you allow it, and no service that could recognise you runs unless you allow it. You can change your mind whenever you like. We do count visits anonymously either way — explained just below.
How we count visits
We want to know roughly how many people visit. Google Analytics loads on every visit, but unless you accept analytics it runs with storage switched off.
In that state it writes nothing to your device, creates no identifier, and cannot tell that two page views came from the same person or recognise you on a later visit. What it reports is a count, not a profile. Nothing is shared for advertising and nothing is joined to any other information about you.
Accept analytics and it stores the cookies listed below and measures in the usual way. Reject analytics — or send a Global Privacy Control signal — and it stays in this anonymous mode: no cookies, no identifier, just the visit count. Because nothing is stored on your device and nothing identifies you, this is not a sale or sharing of personal information, and it is not what a Global Privacy Control signal opts you out of.
Everything else on this page — session replay, and anything used for marketing — only ever loads after you have said yes, and none of it has an anonymous mode.
Global Privacy Control
We recognise and honour the Global Privacy Control (GPC) signal. If your browser or extension sends GPC, we treat it as a valid request to opt out of the sale or sharing of your personal information for targeted advertising — analytics and marketing cookies are switched off automatically and we won't ask you again. You can still turn them on yourself if you want to. The anonymous visit count described above continues, because it stores nothing and identifies nobody, so it is not the sale or sharing that a GPC signal opts you out of.
Separately, most browsers offer a Do-Not-Track (DNT) setting. Because there is still no agreed standard for how sites should interpret DNT, we do not respond to those signals. GPC is the signal we act on.
Categories we use
Strictly necessaryAlways on
Needed for the site to work — your cookie choice, secure forms and spam blocking. These can't be turned off.
| Cookie | Provider | Purpose | Expires |
|---|---|---|---|
| hh-consent | H&H Fresh Fish | Remembers your cookie choices so we don't ask again on every page. | 12 months |
| hh-motion-paused | H&H Fresh Fish | Remembers that you asked us to pause animations, so moving content stays stopped as you browse. Stored in your browser and never sent to us. This is an accessibility preference you explicitly requested, so it is exempt from consent — switching it off would defeat the point of the control. | Until you clear your browser storage |
| hh-skip-external-notice | H&H Fresh Fish | Remembers if you asked us to stop warning you before links that leave our site. Stored in your browser for the current tab only and never sent to us. Like the animation setting, this is a preference you explicitly asked for, so it is exempt from consent. | Until you close the tab |
| uw-uid, uw-tunings, uw-tunings-checksum, uw-icon-locales | UserWay | Powers the accessibility toolbar — larger text, contrast, screen-reader profiles — and remembers the settings you turn on as you browse. uw-uid is a random ID UserWay assigns your browser. These are written when the page loads, not when you first use the toolbar. It loads for everyone: an assistive tool you have to accept tracking to use would defeat its purpose. | Until you clear your browser storage |
| cf_clearance / __cf_bm | Cloudflare | Set by Cloudflare Turnstile, the anti-spam check on our sign-up forms. Distinguishes real visitors from bots. | Up to 30 minutes (__cf_bm) / 1 year (cf_clearance) |
Functional
Remembers preferences beyond the essentials, so the site behaves the way you left it.
We don't currently use any cookies in this category.
Analytics
Shows us which pages and products people actually use, so we can improve them. Measurement only.
| Cookie | Provider | Purpose | Expires |
|---|---|---|---|
| _ga, _ga_G-1X5TP9V9GB | Google Analytics 4 | Counts visits and tells us which pages and products people actually use, so we can improve them. These two cookies are only ever written after you accept analytics. Google's tag itself loads on every visit, but unless you accept it runs with storage switched off — it writes nothing to your device and reports only an aggregate count that cannot be linked to you or to your other visits. | 2 years |
| _clck, _clsk | Microsoft Clarity | Aggregated heatmaps and session replay, so we can see where the site is confusing. _clck holds a pseudonymous ID for this site; _clsk ties the pages of one visit into a single recording. Loads only after you accept analytics, and both are deleted if you turn analytics off. | _clsk one visit; _clck up to 1 year |
| CLID, MUID, ANONCHK, MR, SM | Microsoft (clarity.ms) | Set by Microsoft on their own domain rather than ours when Clarity runs, to recognise a browser across sites that use Clarity. Microsoft also uses MUID for advertising. Because these sit on clarity.ms we can stop them being set, but we can't delete ones already there — clear those in your browser. | ANONCHK a few minutes; MR about a week; CLID and MUID up to about a year |
| hh-anon | H&H Fresh Fish | A random ID that lets us see which seafood people search for, click and buy — so we can put the right things in front of you. It holds no name, email or anything else about you, and it is only created after you accept analytics. Turning analytics back off deletes it. We send those events to Algolia, our search provider, under this ID. | 180 days |
Marketing
Advertising, plus the YouTube videos and maps we embed. This is what counts as “sharing” under California law.
| Cookie | Provider | Purpose | Expires |
|---|---|---|---|
| Mailchimp connected-site cookies | Mailchimp (Intuit) | Connects what you browse here to your email profile, so our newsletters can be about the seafood you're actually interested in, and remembers whether you've already seen a sign-up popup. Mailchimp's script can also place Google remarketing and Facebook advertising pixels. Loads only after you accept marketing. Mailchimp doesn't publish a fixed list of names for these, so we can't name them precisely here. | Up to 1 year |
| NID and related Google identifiers | Google Maps | The map on our shop and farmers' market pages is embedded from Google. It only loads once you accept marketing; decline and we show the address with a plain directions link instead, which sets nothing until you click it. | Up to 6 months |
| YSC, VISITOR_INFO1_LIVE and related playback identifiers | YouTube (Google) | Recipe, product and blog pages embed cooking and dock videos hosted on YouTube. The player only loads once you accept marketing; decline and we show a note in its place with a link to watch on YouTube instead. We use youtube-nocookie.com, which sets nothing until you actually press play. | YSC for the browsing session; the rest up to 6 months |
Changing your mind
Turn a category off whenever you like — “Reject all” sits beside “Accept all” wherever you're asked. We then delete that category's cookies from our own domain and reload the page, so session replay and anything used for marketing stop there and then. Google Analytics keeps counting visits in the anonymous mode described above, without cookies.
Cookies stored under someone else's domain — Microsoft's on clarity.ms, Google's from a video you played — are outside our reach. We stop asking for them, but only your browser can clear the ones already set.
You can also block or delete cookies through your browser settings. Doing so may stop parts of the site working — for example, we'd no longer remember that you asked us not to track you.
Questions
Email [email protected] or write to H&H Fresh Fish, 493 Lake Ave, Suite A, Santa Cruz, CA 95062, United States.