Cookie Policy
Last updated 2026-09-09
Cookies are small files stored by your browser. We use a small number of them, and we set nothing beyond the strictly necessary ones until you tell us we can.
Your choices
The first time you visit we ask whether to set optional cookies. Refusing is one click, in the same place and the same size as accepting, and refusing does not restrict your use of the site. Your answer is stored for six months, and you can change it whenever you like:
You can also clear or block cookies in your browser settings. Blocking strictly necessary cookies will stop you being able to sign in.
Categories we use
- Strictly necessary — you cannot turn these off, because without them there is no signed-in session, no protection against forged requests, and no way to remember that you refused the rest.
- Functional — cookies set by third-party features embedded in particular pages, such as the anti-bot check on sign-in and the payment form at checkout.
- Error reporting — lets us receive a technical report when something breaks in your browser. The report is stripped of your identity before it is sent. Off unless you turn it on.
Every cookie in use
| Cookie | Set by | Category | What it does | Lasts |
|---|---|---|---|---|
hwbids_session | DiecastBids | Strictly necessary | Keeps you signed in. HttpOnly, so page scripts cannot read it. Without it there is no signed-in state at all. | Until sign-out or session expiry. |
hwbids_csrf | DiecastBids | Strictly necessary | Anti-forgery token. Stops another site from making a bid or a payment change in your name. | Until sign-out or session expiry. |
hwbids_consent | DiecastBids | Strictly necessary | Remembers your cookie choices so you are not asked on every page. Storing this is what honours your decision. | 6 months. |
_GRECAPTCHA | Functional | Set by reCAPTCHA when the anti-bot challenge loads on the sign-in, registration and bidding screens. | Up to 6 months (set by Google). | |
__stripe_mid / __stripe_sid | Stripe | Functional | Set by Stripe when a payment form loads, to detect card fraud. Only present on checkout and payment-method screens. | 1 year / 30 minutes (set by Stripe). |
A note on the anti-bot check and the payment form
The Google reCAPTCHA check appears only on the sign-in, registration and bidding screens, and the Stripe payment form only when you add or use a payment method. Both are security measures for actions you have chosen to take, and both set cookies on their own domains when they load. If you would rather they did not, do not use those screens; the rest of the site works without them. What each provider does with that data is covered by their own policies, linked from our Privacy Policy.
We do not use advertising or tracking cookies
There is no advertising network, no cross-site tracking pixel, and no behavioural profiling on this site. If that ever changes, it will appear in the table above and you will be asked again before anything is set.
Questions
Email [not yet configured].
Version 2026-09-09. We will post any change on this page and update the version date. Where a change materially affects your rights, we will tell registered users before it takes effect.