TAS Legal

Cookie & Local Storage Policy

Last updated August 9, 2026

This page names every cookie and every browser storage key this site uses, says what each one holds and how long it lasts, and explains what stops working if you delete them.

Phase 1 note: this document is a structurally complete template. It has not yet been reviewed by counsel and must be before any real sale is made.

1. What this page covers

“Cookies” is the familiar word, but it is only part of the picture. A website can keep information in your browser in several different places, and the legal and practical questions are the same for all of them: what is stored, who can read it, how long does it live, and can you get rid of it.

This page covers all three mechanisms this site can use:

Cookies — small values sent to our server with every request to the site.
Local storage — values kept in your browser indefinitely, readable only by pages on this domain, and never sent to a server unless our own code deliberately sends them.
Session storage — the same as local storage, except the browser throws it away when you close the tab.

The distinction matters here, because almost everything this site remembers about you is in local or session storage, not in a cookie, and therefore never leaves your machine.

2. What we do not use

Stated plainly, because most sites of this kind cannot say it: this site currently sets no advertising cookies, no third-party tracking cookies, and no cross-site identifiers. Specifically, there is at present:

No advertising or retargeting pixel. No Meta pixel, no Google Ads tag, no TikTok pixel, no LinkedIn Insight tag, no conversion-tracking beacon of any kind. Nothing on this site is building an advertising profile of you, here or anywhere else.
No third-party analytics. No Google Analytics, no Segment, no product-analytics SDK. We do not measure your browsing with a vendor’s script.
No social embeds or share widgets, which are one of the most common ways tracking cookies arrive on a page without anyone intending it.
No session-replay or heatmap recording. Nothing records your mouse movements, scrolling or keystrokes.
No fingerprinting — we do not probe your browser for canvas, font, audio or device characteristics to identify you without storage.

This is a statement of fact about the current build, not a permanent promise about a business that has not launched. Section 10 sets out what has to happen before that changes.

3. Browser storage, key by key

Four keys. That is the complete list. Every one of them is written by this site’s own code, readable only by pages on this domain, and never transmitted to a TAS server or to anyone else.

Every browser storage key this site writes, what it holds, and how long it survives. You can verify this list yourself in your browser’s developer tools under Application → Storage.
Key	Where	What it holds	How long	Category
`tas.v1`	localStorage	Your cart lines, saved items, delivery ZIP code, account and membership state, and your order history. This is the whole shopping session — in this build it lives in your browser and nowhere else.	Until you clear it	Strictly necessary
`tas.age`	localStorage	A record that you confirmed you are 18 or older at the site-entry age gate, stored as a true/false flag and a timestamp. It holds no name, no date of birth, and no identifier.	365 days from the confirmation	Strictly necessary
`tas.age.denied`	sessionStorage	A record that you answered the age gate by selecting that you are under 18, so the site stays closed for the rest of that browsing session. Deliberately not persisted beyond the session, so a misclick is undone by opening a new one.	Until you close the browser tab	Strictly necessary
`tas.banner`	sessionStorage	A single value recording that you dismissed the announcement bar at the top of the page, so it does not come back on every page you visit.	Until you close the browser tab	Functional (optional)

Two things about tas.v1 deserve to be said out loud. First, in this build it is the only place your cart, addresses and order history exist — there is no server-side copy, which is why clearing it is irreversible. Second, because it is ordinary browser storage, it is readable by anyone else who uses the same browser profile on the same device. If you share a computer, sign out and clear the storage when you are finished.

The two age-gate keys are worth being equally precise about. The age gate is a self-declaration held entirely in your browser. It collects no personal information, transmits nothing to a server, and cannot identify you. It records that someone using this browser answered the question, and when. It is the first of two checks; the real age requirements — 18 for rifle and shotgun ammunition, 21 for handgun ammunition — are enforced again at checkout against what is actually in your cart, and again by the adult signature the carrier collects at your door. See the Compliance & Restrictions page.

4. Cookies we set

None, for shoppers. Browsing the catalog, filling a cart and going through checkout sets no cookie at all.

There is exactly one cookie in the application, and you will never receive it. tas_ops is set only on the internal operations tool at /ops, which is restricted to TAS staff and shows wholesale cost and margin data. It stores an access key so that links within that tool keep working. It is HttpOnly, secure, scoped to the /ops path, and expires after 12 hours. It is never set on a customer-facing page and holds nothing about you.

Your browser may also receive infrastructure cookies from our hosting provider for load balancing, security or abuse prevention. These are operational, contain no marketing identifier, and are not used to profile you.

5. Strictly necessary and optional

Strictly necessary

tas.v1, tas.age and tas.age.denied are strictly necessary. They are not marketing tools; they are the mechanism by which the site works at all and by which we meet an age-verification obligation. Without tas.v1 a cart cannot survive a page navigation. Without the age keys the gate would block the site on every single page load.

We do not ask for consent to strictly necessary storage, because there is no version of this site that functions without it and a consent banner offering a choice that does not exist would be theatre. You can still block or delete it — see section 7 — and the site will keep working, it will simply keep forgetting you.

Optional

tas.banner is optional. It is written only when you press the dismiss button on the announcement bar, it holds one value, and if you never dismiss the bar it is never written at all. Deleting it costs you nothing but the reappearance of the bar.

Categories we do not currently have

There is no analytics category and no advertising category on this site today, so there is nothing in those categories to consent to or decline. If that changes, section 10 governs.

6. None of it is sold or shared

We do not sell the contents of your browser storage, and we do not share it for cross-context behavioural advertising. There is no data broker relationship, no advertising co-operative, no audience-matching arrangement, and no pixel sending your cart contents to a third party.

This is not merely a policy commitment in this build — it is structural. The keys in section 3 are never transmitted anywhere, so there is nothing to sell even if we wanted to. Your rights under California and other state law, including the right to opt out of sale and sharing, are set out on Your Privacy Choices.

We also treat what you look at here as sensitive. Purchase history for ammunition is not ordinary retail data, and we do not build advertising audiences from it, on this site or anywhere else.

7. How to clear or block it

You do not need our permission or a preference centre. Everything on this page is under your control from your own browser:

Clear it. Every major browser can delete cookies and site data for a single site. Look for “Privacy and security” → “Cookies and site data” → “See all site data” in Chrome and Edge, “Manage Data” under Privacy in Firefox, or “Manage Website Data” under Privacy in Safari. Clearing site data for this domain removes all four keys at once.
Inspect it first. Open your browser’s developer tools, go to Application (Chrome, Edge) or Storage (Firefox, Safari), and you can read every value listed in section 3 and delete them individually.
Block it. Browser settings can block site data for this domain entirely. The site tolerates this: our code catches storage failures rather than crashing, so you can browse normally, but nothing will be remembered between page loads and the age gate will appear every time.
Use a private window. Private and incognito windows discard all of it when the window closes, with no setting to change.
Sign out. Signing out of your account clears the account portion of tas.v1 without touching the rest.

8. What breaks when you clear it

Honestly and specifically, so that you can decide with the facts in front of you:

The consequence of deleting each key. Nothing here is recoverable by contacting us, because in this build there is no server-side copy to recover from.
If you clear	What happens
`tas.v1`	Your cart empties. Saved items, your delivery ZIP, your signed-in state, your membership state and your order history all disappear with it. In this build that is permanent — there is no account on a server holding a second copy.
`tas.age`	The age gate returns on your next visit and you will be asked to confirm again. Nothing else is affected.
`tas.age.denied`	The session-scoped block is lifted and you are asked the age question again rather than being held out. Closing the browser does the same thing.
`tas.banner`	The announcement bar comes back. You can dismiss it again.

If you are about to clear site data and you have an order in progress, note the order number first. Nothing else on this list is worth protecting.

9. Third-party content and fonts

Third-party assets are the usual back door for tracking, so it is worth being specific about what this site loads from elsewhere.

Fonts are self-hosted. The typeface is downloaded and bundled at build time and served from our own domain. Your browser makes no request to a font provider and no font provider sees your IP address.
Product imagery is generated in the page. The product art on this site is drawn as vector graphics by our own code rather than loaded from an image host or a supplier CDN.
No embedded video, map or social widget anywhere on the site.

If you follow a link off this site — to a manufacturer, a carrier’s tracking page, a state agency — you are on their site under their policy, and they may set whatever they like. We have no control over that and do not receive anything from it.

When payment processing goes live, the payment provider will set its own cookies on the checkout page for fraud prevention and to secure the transaction. Those are strictly necessary to take a payment safely. We will name the provider on this page before that happens.

10. If we add analytics or advertising

This is a business that intends to grow, and it is realistic that measurement will be added. So the commitment worth making is a procedural one rather than a promise never to change:

This page is updated first. No new cookie, pixel, tag or storage key goes live before it is listed here by name, with its purpose, its lifetime and who receives the data. If it is not on this page, it should not be in your browser, and if you find one that is not, tell us — see section 12.
Nothing beyond strictly necessary is switched on without a consent mechanism. If analytics or advertising storage is introduced, it will be preceded by a consent control that lets you decline, that defaults to off for non-essential categories, and that is as easy to refuse as it is to accept. Declining will never cost you access to the site or a worse price.
Purchase history stays out of advertising. Whatever measurement is added, we will not build advertising audiences from what calibers or products you looked at or bought. That data is treated as sensitive, and section 6 of this page is the standard we intend to hold ourselves to.
Global Privacy Control will be honoured as a valid opt-out signal from the day any sale-or-share category could exist. See Your Privacy Choices.

11. Changes to this page

The “last updated” date at the top of this page changes whenever this document does. Material changes — a new category of storage, a new recipient of data, a new third-party script — will be notified on the site before they take effect, not quietly backdated.

Because the list in section 3 is short and verifiable, you never have to take our word for it. Open your developer tools and compare.

12. How to contact us

Questions about this page, or a storage key you found that is not listed: privacy@topammosupply.com
Order support: support@topammosupply.com
Support hours: Monday to Friday, 8am to 6pm Eastern.
Related reading: Privacy Policy, Your Privacy Choices, and the Terms of Service.