TAS Legal

Cookie & Local Storage Policy

Last updated September 6, 2026

This page names every cookie and every browser storage key this site uses, says what each one holds and how long it lasts, and explains what stops working if you delete them.

Phase 1 note: this document is a structurally complete template. It has not yet been reviewed by counsel and must be before any real sale is made.

1. What this page covers

“Cookies” is the familiar word, but it is only part of the picture. A website can keep information in your browser in several different places, and the legal and practical questions are the same for all of them: what is stored, who can read it, how long does it live, and can you get rid of it.

This page covers all three mechanisms this site can use:

Cookies: small values sent to our server with every request to the site.
Local storage: values kept in your browser indefinitely, readable only by pages on this domain, and never sent to a server unless our own code deliberately sends them.
Session storage: the same as local storage, except the browser throws it away when you close the tab.

The distinction matters here, because almost everything this site remembers about you is in local or session storage, not in a cookie, and therefore never leaves your machine.

2. What we do not use

Stated plainly, because most sites of this kind cannot say it: this site currently sets no advertising cookies and no cross-site identifiers. Specifically, there is at present:

No advertising or retargeting pixel. No Meta pixel, no Google Ads tag, no TikTok pixel, no LinkedIn Insight tag, no conversion-tracking beacon of any kind. Nothing on this site is building an advertising profile of you, here or anywhere else.
No general-purpose analytics. No Google Analytics, no Segment, no product-analytics SDK measuring the site as a whole. The one third-party script that does see pages you visit is the live chat widget, named in full below and in section 4.
No social embeds or share widgets, which are one of the most common ways tracking cookies arrive on a page without anyone intending it.
No session-replay or heatmap recording. Nothing records your mouse movements, scrolling or keystrokes.
No fingerprinting: we do not probe your browser for canvas, font, audio or device characteristics to identify you without storage.

The one exception, named

We use Intercom to run the live chat button. It is a support tool rather than an advertising or analytics product, but it is a third-party script and it does more than draw a button, so it is set out here rather than buried:

It sets its own cookies on this site, listed by name in section 4, which is how a conversation you start on one page is still there when you open another.
It records the pages you visit while the widget is loaded, so that whoever answers you can see what you were looking at instead of asking you to describe it.
If you are signed in, it receives your email address and an account identifier, so the person answering knows who they are talking to without asking you to prove it. If you are browsing signed out, it receives neither and the conversation is anonymous.
It does not receive your order history, your addresses or anything about your payment method. If you type those things into the chat yourself, Intercom holds them the same way any support inbox would.
It is not used for advertising, is not shared with an ad network, and does not follow you to other sites.

Blocking it, with an extension or by refusing its cookies, costs you the chat button and nothing else. Everything on this site works without it.

This is a statement of fact about the current build, not a permanent promise about a business that has not launched. Section 10 sets out what has to happen before that changes.

3. Browser storage, key by key

Five keys. That is the complete list. Every one of them is written by this site’s own code, readable only by pages on this domain, and never transmitted to a TAS server or to anyone else.

Every browser storage key this site writes, what it holds, and how long it survives. You can verify this list yourself in your browser’s developer tools under Application → Storage.
Key	Where	What it holds	How long	Category
`tas.v1`	localStorage	Your cart lines, saved items, delivery ZIP code, account and membership state, and your order history. This is the whole shopping session: in this build it lives in your browser and nowhere else.	Until you clear it	Strictly necessary
`tas.age`	localStorage	A record that you confirmed you are 18 or older at the site-entry age gate, stored as a true/false flag and a timestamp. It holds no name, no date of birth, and no identifier.	365 days from the confirmation	Strictly necessary
`tas.age.denied`	sessionStorage	A record that you answered the age gate by selecting that you are under 18, so the site stays closed for the rest of that browsing session. Deliberately not persisted beyond the session, so a misclick is undone by opening a new one.	Until you close the browser tab	Strictly necessary
`tas.banner`	sessionStorage	A single value recording that you dismissed the announcement bar at the top of the page, so it does not come back on every page you visit.	Until you close the browser tab	Functional (optional)
`tas.shipto.dismissed`	sessionStorage	The state you last checked against our shipping restrictions, so the answer is not shown to you again on every page for the rest of the session. It holds a two-letter state code and nothing else.	Until you close the browser tab	Functional (optional)

Two things about tas.v1 deserve to be said out loud. First, in this build it is the only place your cart, addresses and order history exist: there is no server-side copy, which is why clearing it is irreversible. Second, because it is ordinary browser storage, it is readable by anyone else who uses the same browser profile on the same device. If you share a computer, sign out and clear the storage when you are finished.

The two age-gate keys are worth being equally precise about. The age gate is a self-declaration held entirely in your browser. It collects no personal information, transmits nothing to a server, and cannot identify you. It records that someone using this browser answered the question, and when. It is the first of two checks; the real age requirements (18 for ammunition in a cartridge only a long gun chambers, 21 for handgun ammunition) are enforced again at checkout against what is actually in your cart, and again by the adult signature the carrier collects at your door. See the Compliance & Restrictions page.

4. Cookies we set

None of our own, for shoppers. Browsing the catalog, filling a cart and going through checkout sets no TAS cookie at all. The shopping session lives in your browser’s local storage, listed key by key in section 3.

The live chat widget sets three. They come from Intercom, the tool behind the chat button, and they are what let a conversation continue across pages and visits instead of starting over each time.

intercom-id-z78a0nmo: an anonymous visitor identifier, so a reply reaches the person who asked. It holds no name or email.
intercom-session-z78a0nmo: the current chat session.
intercom-device-id-z78a0nmo: identifies the browser, so an unread reply can be shown when you come back.

Their lifetimes are set by Intercom rather than by us: roughly nine months for the two identifiers and about a week for the session. None of them is an advertising cookie, none is shared with an ad network, and clearing them costs you nothing but the history in the chat window.

There is exactly one cookie in the application, and you will never receive it. tas_ops is set only on an internal operations tool restricted to TAS staff. It stores an access key so that links within that tool keep working. It is HttpOnly, secure, path-scoped, and expires after 12 hours. It is never set on a customer-facing page and holds nothing about you.

Your browser may also receive infrastructure cookies from our hosting provider for load balancing, security or abuse prevention. These are operational, contain no marketing identifier, and are not used to profile you.

5. Strictly necessary and optional

Strictly necessary

tas.v1, tas.age and tas.age.denied are strictly necessary. They are not marketing tools; they are the mechanism by which the site works at all and by which we meet an age-verification obligation. Without tas.v1 a cart cannot survive a page navigation. Without the age keys the gate would block the site on every single page load.

We do not ask for consent to strictly necessary storage, because there is no version of this site that functions without it and a consent banner offering a choice that does not exist would be theatre. You can still block or delete it (see section 7), and the site will keep working, it will simply keep forgetting you.

Optional

tas.banner is optional. It is written only when you press the dismiss button on the announcement bar, it holds one value, and if you never dismiss the bar it is never written at all. Deleting it costs you nothing but the reappearance of the bar.

Support

The three intercom- cookies in section 4 are functional rather than strictly necessary: the site works fully without them, and blocking them costs you the chat button and the memory of a conversation you had already started. They are not written until the chat widget loads.

Categories we do not currently have

There is no advertising category on this site today, and no general-purpose analytics category, so there is nothing in those to consent to or decline. If that changes, section 10 governs.

6. None of it is sold or shared

We do not sell the contents of your browser storage, and we do not share it for cross-context behavioural advertising. There is no data broker relationship, no advertising co-operative, no audience-matching arrangement, and no pixel sending your cart contents to a third party.

This is not merely a policy commitment in this build. It is structural. The keys in section 3 are never transmitted anywhere, so there is nothing to sell even if we wanted to. Your rights under California and other state law, including the right to opt out of sale and sharing, are set out on Your Privacy Choices.

We also treat what you look at here as sensitive. Purchase history for ammunition is not ordinary retail data, and we do not build advertising audiences from it, on this site or anywhere else.

7. How to clear or block it

You do not need our permission or a preference centre. Everything on this page is under your control from your own browser:

Clear it. Every major browser can delete cookies and site data for a single site. Look for “Privacy and security” → “Cookies and site data” → “See all site data” in Chrome and Edge, “Manage Data” under Privacy in Firefox, or “Manage Website Data” under Privacy in Safari. Clearing site data for this domain removes all five keys at once.
Inspect it first. Open your browser’s developer tools, go to Application (Chrome, Edge) or Storage (Firefox, Safari), and you can read every value listed in section 3 and delete them individually.
Block it. Browser settings can block site data for this domain entirely. The site tolerates this: our code catches storage failures rather than crashing, so you can browse normally, but nothing will be remembered between page loads and the age gate will appear every time.
Use a private window. Private and incognito windows discard all of it when the window closes, with no setting to change.
Sign out. Signing out of your account clears the account portion of tas.v1 without touching the rest.

8. What breaks when you clear it

Honestly and specifically, so that you can decide with the facts in front of you:

The consequence of deleting each key. Nothing here is recoverable by contacting us, because in this build there is no server-side copy to recover from.
If you clear	What happens
`tas.v1`	Your cart empties. Saved items, your delivery ZIP, your signed-in state, your membership state and your order history all disappear with it. In this build that is permanent: there is no account on a server holding a second copy.
`tas.age`	The age gate returns on your next visit and you will be asked to confirm again. Nothing else is affected.
`tas.age.denied`	The session-scoped block is lifted and you are asked the age question again rather than being held out. Closing the browser does the same thing.
`tas.banner`	The announcement bar comes back. You can dismiss it again.

If you are about to clear site data and you have an order in progress, note the order number first. Nothing else on this list is worth protecting.

9. Third-party content and fonts

Third-party assets are the usual back door for tracking, so it is worth being specific about what this site loads from elsewhere.

Fonts are self-hosted. The typeface is downloaded and bundled at build time and served from our own domain. Your browser makes no request to a font provider and no font provider sees your IP address.
Product imagery is generated in the page. The product art on this site is drawn as vector graphics by our own code rather than loaded from an image host or a supplier CDN.
No embedded video, map or social widget anywhere on the site.
Live chat is loaded from Intercom. This is the one third-party script on the site. It is fetched after the page has finished loading, so it cannot slow down or block anything you came here to do, and Intercom sees your IP address as any server does when your browser asks it for a file. What it stores is set out in sections 2 and 4.

If you follow a link off this site (to a manufacturer, a carrier’s tracking page, a state agency), you are on their site under their policy, and they may set whatever they like. We have no control over that and do not receive anything from it.

When payment processing goes live, the payment provider will set its own cookies on the checkout page for fraud prevention and to secure the transaction. Those are strictly necessary to take a payment safely. We will name the provider on this page before that happens.

10. If we add analytics or advertising

This is a business that intends to grow, and it is realistic that measurement will be added. So the commitment worth making is a procedural one rather than a promise never to change:

This page is updated first. No new cookie, pixel, tag or storage key goes live before it is listed here by name, with its purpose, its lifetime and who receives the data. If it is not on this page, it should not be in your browser, and if you find one that is not, tell us (see section 12).
Nothing beyond strictly necessary is switched on without a consent mechanism. If analytics or advertising storage is introduced, it will be preceded by a consent control that lets you decline, that defaults to off for non-essential categories, and that is as easy to refuse as it is to accept. Declining will never cost you access to the site or a worse price.
Purchase history stays out of advertising. Whatever measurement is added, we will not build advertising audiences from what calibers or products you looked at or bought. That data is treated as sensitive, and section 6 of this page is the standard we intend to hold ourselves to.
Global Privacy Control will be honoured as a valid opt-out signal from the day any sale-or-share category could exist. See Your Privacy Choices.

11. Changes to this page

The “last updated” date at the top of this page changes whenever this document does. Material changes (a new category of storage, a new recipient of data, a new third-party script) will be notified on the site before they take effect, not quietly backdated.

Because the list in section 3 is short and verifiable, you never have to take our word for it. Open your developer tools and compare.

12. How to contact us

Questions about this page, or a storage key you found that is not listed: privacy@topammosupply.com
Order support: support@topammosupply.com
Support hours: Monday to Friday, 8am to 6pm Eastern.
Related reading: Privacy Policy, Your Privacy Choices, and the Terms of Service.