Cookie Policy

• Sign-in cookies, with names starting sb- — keep a Merchant or member of staff signed in; strictly necessary; set by us through our sign-in provider's software; up to 400 days, renewed while you use the admin and removed when you sign out. The value can be split across several numbered cookies.

• merkora-rail — remembers whether you collapsed the admin's side navigation; preference cookie; set by us; 1 year.
• theme — remembers your light or dark display choice; preference, kept in local storage; set by us when you change the setting; until you clear it.
• merkora:recent-colors — the colors you used most recently in the admin's color picker; preference, kept in local storage; set by us; until you clear it.
• Names starting merkora:composer:view: — your zoom level and position in the theme editor, one entry per theme; preference, kept in local storage; set by us; until you clear it.

The Store cannot work without these, so the cookie banner does not switch them off.

• __Host-cart — the items in your cart, as product identifiers and quantities; strictly necessary; set by the Store; 14 days.
• __Host-discount — a discount code you entered or that came with a link you followed, with a signature that proves the Store accepted it; strictly necessary; set by the Store; 14 days.
• __Host-discount_error — tells the cart page why a discount code was refused, so it can show a message; strictly necessary; set by the Store; 60 seconds, and removed as soon as the message is shown.
• __Host-checkout_email — the email address you entered at checkout, with a signature, so that discounts limited to one use per customer are priced correctly if you return to checkout; strictly necessary; set by the Store; 1 day, and removed when you place the order.
• __Host-shopper — keeps you signed in to your Shopper account at that Store; it holds a random token and nothing else; strictly necessary; set by the Store when you sign in; 30 days, and removed when you sign out.
• __Host-funnel — keeps your place in a promotional checkout, so that an offer you accept after buying is added to the same order; it holds a random token; strictly necessary; set by the Store when you buy through one of these pages; 2 hours.
• merkora_form_code — holds a discount code a sign-up form has just given you, so the confirmation page can show it; strictly necessary; set by the Store; 5 minutes, and limited to that form's page.
• theme_preview — set only when a Merchant or a member of staff opens a preview link for an unpublished design; it shows that design in place of the live one; strictly necessary; set by the Store; up to 12 hours, or until the preview is closed.
• __Host-merkora_consent — remembers your cookie choice. See What the Store records about your choice; strictly necessary; written by the Store's banner in your browser; 180 days.

• __Host-country — the country you picked in the Store's country selector, used to show the right market and shipping options; preference; set by the Store only when you pick a country; 1 year.
• Names starting merkora:form: — remembers that you closed or completed a pop-up sign-up form, so it is not shown to you again too soon; preference, kept in local storage and session storage; set by the Store; the local entry stays until you clear it.

These are set by the Store itself. Each entry says when it is set, because some are set whether or not you have answered the cookie banner.

• merkora_chk — marks that you opened checkout, so the Store's own statistics count one “checkout started” instead of one for every reload; it holds the value 1 and no identifier; analytics; set by the Store when you open checkout, whether or not you have answered the banner, on Stores where the Merchant uses Store analytics; 30 minutes.
• __Host-funnel_ab_ followed by the page's name — remembers which version of a promotional page you were shown, so you keep seeing the same one while the Merchant compares versions; analytics; set by the Store when you open one of these pages, whether or not you have answered the banner; 30 days.
• __Host-attr — how you arrived: campaign tags from the link you followed (the “utm” values), the first page you landed on and the site that referred you, kept when Analytics is allowed; and advertising click identifiers from the link (fbclid, ttclid, gclid) with the time they were seen, kept when Marketing is allowed. Both are saved with an order you place, and when Marketing is allowed the click identifiers are sent to Meta or TikTok with the purchase if the Merchant has connected them. Analytics and marketing; written by the Store's script in your browser; 30 days.
• merkora_sid — marks that this visit has already been counted as one visit in the Store's statistics; analytics, kept in session storage; set by the Store's script only when Analytics is allowed; until you close the tab.
• merkora_pending_atc — holds an “added to cart” event for a moment while the page changes, so it can be reported on the next page; it is reported to connected tools only if they are allowed for you; analytics and marketing, kept in session storage; set by the Store's script when you add to the cart, whether or not you have answered the banner; removed on the next page.
• merkora_purchased — the numbers of your most recent orders that have already been reported to connected tools, so that reloading the order page does not report a purchase twice; analytics and marketing, kept in local storage; set by the Store's script only when a purchase is reported to one of those tools, which happens only when that tool is allowed for you; until you clear it.
• merkora_gpc_logged — notes that your browser's Global Privacy Control signal has been recorded for this Store, so it is not recorded again on every page; strictly necessary, kept in local storage; set by the Store's script when your browser sends the signal, without asking; until you clear it.

A Store that has no cookie banner, because the Merchant uses neither Store analytics nor any connected advertising or analytics tool, asks no one. On such a Store the __Host-attr cookie keeps campaign tags without asking, and keeps click identifiers unless your browser sends a Global Privacy Control signal.

Stores also count page views with a small request to the Store's own address. It uses no cookie and is counted in the Store's daily totals only.

If a Merchant places a YouTube or Vimeo video on a page, the player loads from that company when the page loads, and the cookie banner does not hold it back. The platform uses YouTube's privacy-enhanced address (youtube-nocookie.com) and asks Vimeo not to track. The player still connects your browser to that company.

Merchants can also add their own code to a Store's theme. That code can set cookies that are not listed here. The banner holds back a Merchant's script only if the Merchant has marked it to wait for Analytics or Marketing consent; other theme code runs when the page loads. The Merchant is responsible for the code it adds and for describing it in its own privacy policy. Theme code does not run on checkout, order status, Shopper account, review or promotional checkout pages.

A Store shows a cookie banner, titled “Cookie preferences”, whenever the Merchant uses Store analytics or has connected an advertising or analytics tool. It has three buttons:

• Accept all — turns on Analytics and Marketing.
• Reject non-essential — keeps both off.
• Preferences — shows the three categories, “Strictly necessary” (always on), “Analytics” and “Marketing”, each with its own switch, and a “Save choices” button.

Where the banner asks, the connected tools do not load until you choose, and until then the Store tells Google's tags that consent is denied. Rejecting takes one click, the same as accepting.

By default the banner asks every visitor first, wherever they are.

A Merchant can instead choose to ask first only for visitors in the European Union, the European Economic Area, the United Kingdom and Switzerland. In that mode, visitors elsewhere are not shown the banner: Analytics and Marketing are on for them from the start, except that Marketing stays off if their browser sends a Global Privacy Control signal or their Shopper account has opted out. They can turn either off at any time through the “Your Privacy Choices” link. The Store works out where you are from the country our hosting provider derives from your IP address. If the country is unknown, the banner asks first.

You can change your choice at any time through the link described in Your Privacy Choices. When you turn a category off, the Store deletes that category's cookies from the list in Cookies from advertising and analytics companies on the Store's address and reloads the page, so the tools that were running stop.

Global Privacy Control is a browser setting that tells websites you do not want your personal information sold or shared. When your browser sends it, a Store keeps Marketing off for you without asking. The banner's first button then reads “Accept analytics” and leaves Marketing off, and the Store shows “Opt-out request honored”.

Marketing turns on with the signal present only if you switch it on yourself under Preferences. The same rule applies to purchase events a Store sends from our servers.

A Store with a banner also shows a way back to your choices on every page: a link in the footer, normally labeled “Your Privacy Choices” and marked with California's opt-out icon, or a small button with the same label and icon in the corner of the page if the Store's design has no such link.

Opening it shows your choices with one button first: “Do not sell or share my personal information”. Pressing it turns Marketing off and leaves Analytics as it was, so Google Analytics, which is in the Analytics category, keeps following your Analytics choice. Advertising companies' cookies are removed and the Store stops sending them your activity and purchases. The Store then shows “Opt-out request honored”.

If you are signed in to your Shopper account at that Store when you opt out, reject, switch Marketing off or arrive with Global Privacy Control on, the opt-out is saved to your account. It then applies on any device where you sign in to that Store, and to purchase events sent from our servers, until you switch Marketing back on yourself, while signed in, in a panel that showed you the opt-out.

So that a Store can show what you chose and when, your choice is recorded in two places.

• In your browser — the __Host-merkora_consent cookie holds your Analytics and Marketing choices, the time you made them, the version of the banner you saw, a random identifier created for that browser, and markers showing whether you opted out with the “Do not sell or share” button or turned Marketing on while Global Privacy Control was active.
• On our servers, for the Merchant — each choice adds one entry to the Store's consent record: the Store, the same random identifier, your customer record if you were signed in, what you chose, whether Global Privacy Control was on, how the choice was made, the country and region you were in, the banner version and the time. The entry does not include your IP address or your browser details. Entries are kept for 36 months.

A Global Privacy Control signal that a Store honors is recorded in the same way.