Cookie policy
Everything this site stores on your device, named individually, with what each one is for and how long it lasts.
This site stores a handful of things in your browser so that it can work at all: your basket, your sign-in if you have an account, a short record of the orders you have placed from this device, and, for as long as a tab stays open, what you have typed into an order or reservation form. It sets no analytics storage and no advertising storage. There is no Google Analytics, no Meta pixel, no ad network, no remarketing tag, no session recording, no heatmap, no social button and no chat widget. Visits are counted, but by a tool that stores nothing on your device (section 5). Nothing here builds a profile of you.
1. The rules this page answers to
Two rules stack, and it is worth keeping them apart. Storing or reading anything on your device is governed by article XII.13 of the Code of Economic Law, which covers cookies, local storage, session storage, IndexedDB and service-worker caches alike, whether or not what is stored is personal data. It permits storage without consent in two cases: storage needed only to carry a communication, and storage strictly necessary to provide a service you explicitly asked for. Everything else needs your opt-in.
What we then do with the data is governed by the GDPR, and is described in the privacy policy.
3. Everything else stored in your browser
None of this is a cookie, all of it is storage on your device, and every item is exempt from consent because the site cannot do the job you asked it to do without it. All of it is first-party: it is kept under this site’s own address and no other site can read it. One row is written by our sign-in provider’s code rather than ours, and it too is kept under our address. It is named individually, because “we use cookies to improve your experience” is precisely the formulation that gets a policy found inadequate.
Local storage stays on this device until it is removed. Session storage belongs to a single browser tab and is not shared with your other tabs, although a tab you duplicate starts with a copy of it. It is gone when the tab is closed, except that some browsers bring it back if you reopen a tab you have just closed.
| Name | Where | What it holds, and why | How long it lasts |
|---|---|---|---|
| basket.v1 | Local storage | The dishes in your basket, with the sizes and choices you picked, so a refresh or a phone call does not empty it. | Until the order is placed, you clear it, or you sign out |
| oh_placements_v1 | Local storage | A short list of the orders placed from this device and the links that track them, so you can find an order again without digging through your email. At most eight. | Each order is used for 7 days and dropped the next time the list is written. All of it is removed when you sign out |
| oh_pending_stamp_v1 | Local storage | The number of the order you have just placed and the time you placed it, so that your stamp card stamps that order in front of you the next time you open it, instead of showing it already inked. | Until the stamp card has shown it, or you sign out. After 6 hours it is ignored, and your next order replaces it |
| oh_reauth | Local storage | A marker written when somebody signs out, so that the next sign-in on this device has to be confirmed rather than continuing silently from a session left open elsewhere. It protects the next person to use a shared phone. | Until the next successful sign-in |
| oh_push_endpoint | Local storage | Which notification address this browser registered, so we do not register it twice. Only if you turned on order notifications. | Until you turn notifications off, or sign out |
| oh_push_owner | Local storage | A scrambled tag for the account that turned on notifications in this browser, so that somebody else signing in here does not see them as theirs. Your account and email address cannot be worked out from it. Only if you turned on order notifications. | Until you turn notifications off, sign out, or another account signs in here |
| oh-install-dismissed | Local storage | That you closed the offer to add this site to your home screen, so this device is not offered it again. It holds the word “yes” and nothing else. | Until you clear this site’s storage in your browser |
| firebase:authUser:… | Local storage | Your account as our identity provider’s sign-in code keeps it while you are signed in: your account identifier, your email address and the tokens that prove the sign-in. The name continues with the public identifier of our sign-in project. Only if you have an account and have signed in. | Until you sign out |
| oh_checkout_address_v1 | Session storage | The delivery address as you typed it on the order screen, and whether you chose delivery or pickup, with the time you last changed it, so going back to the menu for something you forgot, or reloading the page, does not empty the form. Never a price, and never an address from your saved address book. | Only for this browser tab. Removed once the order is confirmed, or when you sign out in this tab. After 30 minutes without a change it is deleted the next time the page reads it, and each keystroke restarts that clock. Closing the tab ends it, subject to the reopened-tab exception above |
| oh_reservation_contact_v1 | Session storage | The name, email address, phone number and note you typed on the reservation form, with the time you last changed them, so going back to change the party size, or reloading the page, does not empty it. | Only for this browser tab. Removed once the request is sent or turned away for too many attempts, or when you sign out in this tab. After 30 minutes without a change it is deleted the next time the page reads it, and each keystroke restarts that clock. Closing the tab ends it, subject to the reopened-tab exception above |
| oh:menu-scroll, oh:menu-scroll-armed | Session storage | How far down the menu you had scrolled, and a flag saying you are on your way back to it, so returning from a dish puts you where you were. A number and a flag, and nothing about you. | Until you close the tab |
| olis-static-v1, olis-shell-v1 | Cache storage | The site’s own images, fonts and scripts, plus the page you see when your connection drops. It deliberately never caches a page, an order, a menu price or anything behind a tracking link. | Until a new version of the site replaces them |
4. Order notifications
If you turn on order notifications, your browser gives us a push subscription: an address for that browser on that device, and the keys needed to encrypt a message to it. That is storage on your device and it requires your consent, which you give through your browser’s own permission prompt rather than through anything on this page. You can withdraw it in your browser’s site settings at any time, and we delete a subscription that has been silent for 90 days.
5. Other people’s storage
Four third parties are reachable from this site. None of them is advertising. One is analytics: Cloudflare Web Analytics, which counts visits without cookies and stores nothing in your browser, and it is the only one that runs on a page where you are simply browsing the menu.
| Who | Where | What happens |
|---|---|---|
| Stripe | Their own payment page, after you leave ours | When you pay, you leave this site for Stripe’s page and type your card details there. What Stripe stores, it stores on its own page under its own policy, for fraud prevention and to secure the payment you started. We do not control it. |
| The account pages, and the sign-in window | Opening the account pages loads a small sign-in frame from Google, and signing in opens their window, where Google sets its own cookies as part of signing you in. None of it happens anywhere else on this site. | |
| OpenStreetMap | The map on our contact page | The map images are fetched by your browser from OpenStreetMap’s servers, so they see your IP address and which part of the map you looked at. They set no storage on your device through us, and this is the only page it happens on. |
| Cloudflare Web Analytics | Every page except order-tracking, payment-return and voucher-status pages | A small script from Cloudflare counts the visit and measures how fast the page loaded, and your browser sends that to Cloudflare. Like any request on the web, it reaches Cloudflare with your IP address; the statistics Cloudflare shows us contain only a country, not the address. It sets no cookie and writes nothing to local storage or anywhere else on your device, which is why it has no row in section 3. The privacy policy says what it records. |
Everything else on our pages (fonts, scripts, images) is served from our own servers. There are no third-party fonts, no video embeds, no social buttons and no review widgets.
6. Why we do not ask you to accept cookies
Because there is nothing here to accept. Everything listed above is strictly necessary to something you asked the site to do, which article XII.13 exempts from consent, so a banner would be asking your permission for storage your permission does not govern. We would rather tell you what we store, on this page, and be held to it.
The visit statistics in section 5 do not change this: Cloudflare Web Analytics stores nothing in your browser. If this site ever adds anything that stores something in your browser for a purpose that is not strictly necessary (analytics that sets a cookie, an embedded map or video, a review widget or a chat box), you will be asked first, on a banner where “Reject all” and “Accept all” sit side by side, at the same size, with nothing pre-ticked and nothing loading before you answer. Refusing will be exactly as easy as agreeing, and you will be able to change your mind at any time. Until then, this page is the whole story.
7. What happens if you block this storage
We would rather say this plainly than let you discover it:
- Blocking local storage means your basket is kept only in the open page: it survives moving around the site, but it is emptied whenever the page reloads, and a new tab starts with an empty one.
- It also signs you out, if you have an account, and you will not be able to stay signed in.
- The list of recent orders on this device lasts only until the page reloads, and so does a stamp waiting to be shown on your card. Your order-tracking links still work. They are also in your email.
- Blocking session storage has the same effect on a half-filled order or reservation form: it survives moving around the site, and is emptied whenever the page reloads or in a new tab. Nothing you have already sent is affected.
- Nothing about the menu, the prices, the allergen information or our contact details depends on any of it.
None of that is a penalty for refusing. It is what those items were for. You can clear everything yourself at any time from your browser’s privacy settings; doing so signs you out and empties your basket.
8. Questions and complaints
About this page or anything on it: [email protected], or telephone 0491220044. If you are not satisfied, you can complain to the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels.
Version 1.0 · last updated September 9, 2026