Cookie Policy

Oddfunk uses cookies only to run the shop: to keep your cart, keep you signed in, keep bots out, and show prices in your currency. We don't use analytics, advertising or social-media tracking cookies, we don't build a profile of you, and we don't sell or share browsing data with anyone.

Before you choose, we only set what's strictly necessary — the currency cookie lasts just for your visit. Nothing is remembered between visits unless you accept.

You can change your choice at any time: open cookie settings.

app.oddfunk.com is run by Neo Next Enterprises, trading as Oddfunk (“Oddfunk”, “we”, “us”), C33, 1st Floor, Business Bay, Lake City, Raiwind Road, Lahore 54790, Punjab, Pakistan. We decide how the information described here is used, which makes us the controller under the EU and UK General Data Protection Regulation (GDPR) and the business under the California Consumer Privacy Act (CCPA). Contact us about anything in this policy at hello@oddfunk.com.

Our representative in the European Union under Article 27 GDPR is Neo Next Enterprises GmbH, Haus Cumberland, Kurfürstendamm 194, 10707 Berlin, Germany. Our UK representative under Article 27 UK GDPR is at Park House, 24 Park Square West, Leeds LS1 2PW, United Kingdom. You can contact them, or us directly, about anything in this policy.

This policy explains how we use cookies and similar technologies. How we handle personal data more generally — orders, accounts, emails — is in our Privacy Policy.

Cookies are small text files a website asks your browser to keep and send back on later visits. Sites also use similar browser features — local storage and session storage — that stay on your device and are never sent to us automatically. This policy covers both, and uses “cookies” for all of them.

First-party cookies are set by app.oddfunk.com itself. Third-party cookies are set by another service we use on a page, such as a payment provider. A session cookie is deleted when you close your browser; a persistent one lasts for the time shown below.

These are strictly necessary for something you asked for — a cart, an account, a secure checkout — so they don't need consent and can't be switched off in the cookie settings. Blocking them in your browser will stop those features from working.

• _medusa_cart_id

  Links your browser to your shopping cart so items stay in it as you browse and check out.

  7 days

• _medusa_jwt

  Keeps you signed in to your customer account (and guest checkout) once you sign in.

  7 days, or until you sign out

• oddfunk_consent

  Remembers the choice you made in the cookie notice — which option, the policy version and when — so we don't ask on every page and can show what you agreed to.

  6 months

• __Secure-next-auth.session-token, __Host-next-auth.csrf-token, __Secure-next-auth.callback-url

  Staff only

  Staff sign-in: keeps a team member signed in, protects the sign-in form against forgery, and returns them to the page they asked for.

  Session token up to 30 days (ends sooner after inactivity or sign-out); the others last for the browser session

• artist-session-token, artist-csrf-token, artist-callback-url

  Artists only

  Artist sign-in for Art Corner, with the same three jobs as the staff cookies above.

  Session token up to 30 days (ends sooner after inactivity or sign-out); the others last for the browser session

These remember a setting so you don't have to choose it again. They only last beyond your visit if you click Accept (or switch Preferences on). Until then, and if you choose Essential only, they work while you browse and are deleted when you close the browser.

• oddfunk_country, oddfunk_currency, oddfunk_region

  The country your order ships to, the currency prices are shown in (USD, EUR or PKR) and the matching store region, so prices, delivery and checkout agree. Set automatically from your country (see “How we pick your currency”), or by you with “Ship to” in the footer or the country you enter at checkout.

  Until you close the browser, unless you accept preference cookies — then 30 days when detected, 1 year when you pick it

• oddfunk_region_src

  Whether you picked the country yourself, so we never override your choice with the detected one.

  Same as above

Kept on your device only; we can't read it from our servers and it isn't shared with anyone.

• cart_id (local storage)

  A reference to your cart, so it survives a page reload.

  Until you clear your browser data or the cart is completed

• oddfunk-dashboard-theme, oddfunk-artcorner-theme (local storage)

  Staff and artists only

  Light or dark mode in the staff and artist workspaces. The choice is also saved to the account.

  Until you clear your browser data

• oddfunk_artist_username (local storage)

  Artists only

  Pre-fills the artist sign-in form with your username, when you ask it to remember you.

  Until you clear your browser data

A few services we depend on set their own cookies, under their own policies. They appear only at the step where they're used.

• Cloudflare Turnstile

  cloudflare.com/privacypolicy

  A security check we may ask for on some forms (such as sign-ups and raffle entries) to keep bots and automated abuse out; there's no check in front of the shop itself. It runs inside a Cloudflare frame (challenges.cloudflare.com) and may store what it needs there to complete the check. Cloudflare says Turnstile doesn't use this for advertising or to track you across sites.

  Set and controlled by Cloudflare

• Stripe (__stripe_mid, __stripe_sid)

  stripe.com/privacy

  Only when you pay by card at checkout: Stripe's payment form uses these to process the payment and detect fraud.

  __stripe_mid 1 year, __stripe_sid 30 minutes

• PayFast

  PayFast's privacy policy

  If you pay with PayFast you are taken to PayFast's own site to complete the payment; any cookies there are PayFast's, under their policy.

  Set and controlled by PayFast

• Oddfunk sign-in service (Keycloak)

  Staff only

  Staff who sign in with single sign-on pass through our own sign-in service, which sets its own session cookies on its domain.

  For the sign-in session

On your first visit we show prices in your local currency — rupees in Pakistan, euros in the eurozone and the UK, and US dollars everywhere else — by working out which country your connection comes from.

We do this without tracking you. Your IP address is looked up on our own server against an offline country database; it is not sent to any outside service, not stored, and not logged. Only the resulting currency is kept, in the preference cookies above. If the country can't be worked out, we use the region in your browser's language setting, and otherwise US dollars.

Working out a country from an IP address is processing of personal data. We rely on our legitimate interest in showing you prices in a currency you can understand and that match what checkout charges. The impact on you is minimal because the address is never kept, and you can object at any time — just pick a country yourself and detection stops for you.

The result can be wrong if you use a VPN or are traveling. Change it any time with “Ship to” in the footer; once you've picked one yourself, we never change it automatically. Your cart is repriced in the new currency.

IP geolocation by DB-IP (IP to Country Lite, licensed under CC BY 4.0).

• No analytics or statistics cookies (no Google Analytics or similar).
• No advertising, retargeting or conversion pixels (no Meta, TikTok or Google Ads tags).
• No social-media widgets that track you across sites.
• No fingerprinting or cross-site tracking of any kind.

If that ever changes, we'll update this policy first and ask for your consent before setting any such cookie.

Under the EU ePrivacy rules and the UK's Privacy and Electronic Communications Regulations (PECR), cookies that aren't strictly necessary need your consent first. Under the GDPR, each use of personal data needs a legal basis:

• Essential cookies — strictly necessary to provide what you ask for, so exempt from consent. Basis: performing our contract with you (your cart, account and order), and our legitimate interest in keeping the shop secure and free of abuse.
• Preference cookies — your consent, given with Accept and withdrawn at any time in cookie settings. Withdrawing doesn't affect what happened before.
• Currency detection — our legitimate interest, as explained above.
• Payment providers' cookies — performing the contract (taking your payment) and preventing fraud.

We keep a record of your choice (which option, the policy version and when) in the oddfunk_consent cookie on your device. We don't make automated decisions about you, and nothing here involves profiling.

We operate from Pakistan, and our hosting and the providers listed above may process data in other countries, including the United States. Where data from the EU, EEA or UK goes to a country without an adequacy decision, we rely on the providers' safeguards — such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework — under their own terms. The cookies in this policy hold very little: mostly random identifiers and your currency.

Cookie settings. Use cookie settings (also in the footer of every page) to allow or refuse preference cookies. Your choice is kept for six months, after which we ask again.

Your browser. Every browser lets you see, delete and block cookies, usually under Settings → Privacy. Deleting our cookies empties your cart and signs you out; blocking essential cookies stops the cart, sign-in and checkout from working.

Global Privacy Control. If your browser sends a GPC signal, we treat it as a valid opt-out: we apply “Essential only” automatically and tell you we've done so. You can still change it in cookie settings.

Do Not Track. There's no agreed standard for responding to it, and since we don't track you across sites, there's nothing for it to switch off.

EU, EEA and UK (GDPR). You have the right to access the personal data we hold about you, to correct it, to have it erased, to restrict or object to how we use it (including our use of legitimate interests), to receive it in a portable format, and to withdraw consent at any time. You also have the right to complain to a data protection authority — in the EU, the one where you live or work; in the UK, the Information Commissioner's Office (ico.org.uk).

Elsewhere. Many other laws give similar rights — including Brazil's LGPD, Canada's PIPEDA, Switzerland's FADP, and the US state laws below. Wherever you are, you can ask us what we hold about you, ask us to correct or delete it, or withdraw consent.

How to ask. Email hello@oddfunk.com with your request. We may need to confirm it's you before acting, and we'll reply within one month (GDPR) or 45 days (California), telling you if we need longer and why. It's free. Most of what cookies hold sits only in your browser, and you can delete it yourself at any time.

This section is our notice at collection under the CCPA as amended by the CPRA, and also applies under other US state privacy laws (such as Virginia, Colorado, Connecticut and Texas).

• What cookies collect: identifiers (random cart, session and sign-in identifiers; your IP address, used for a moment to find your country and not kept) and internet activity within this site needed to run your cart and checkout. No sensitive personal information.
• Why: the business purposes in this policy — providing the shop, security and fraud prevention, and remembering your currency.
• How long: as listed for each cookie above.
• No selling or sharing. We do not sell personal information, and do not “share” it for cross-context behavioral advertising — and haven't in the past 12 months. We have no actual knowledge of selling or sharing data of anyone under 16. So there's nothing to opt out of, though a GPC signal is honored as described above.
• Your rights: to know what we collect and how it's used, to delete it, to correct it, to opt out of sale or sharing, and to limit use of sensitive information (we have none). You can use an authorized agent. We won't treat you differently — no different prices or service — for using any of these rights.

We'll update this page whenever we add, remove or change a cookie, and change the date at the top. If a change affects what you agreed to, we'll ask you again in the cookie notice. For how we handle personal data more broadly, see the Privacy Policy.

Questions about cookies or your data: hello@oddfunk.com.