| better-auth.session_token | Signs a logged-in session. Without it, the dashboard cannot remember who you are between requests. | Strictly necessary | Session, renewed for up to 30 days |
| better-auth.csrf_token | Cross-site request forgery defence. Pairs with the session cookie so we can reject requests that did not originate from the dashboard. | Strictly necessary | Session |
| shopmcp_analytics_consent | Records whether you accepted or declined optional analytics so we can honour that choice across ShopMCP subdomains. | Strictly necessary | 365 days |
| _ga / _ga_<container-id> | Google Analytics pseudonymous browser and session identifiers. Set only after you accept analytics; never used to send connected-store data or email-bearing URLs. | Analytics | Up to 2 years |
| shopmcp:ga4:* | First-party local storage used after consent to prevent duplicate onboarding, integration, first-result, trial, and purchase events. Events waiting for your choice are held only in page memory, not browser storage. | Analytics | 30 to 400 days |
| shopmcp.active_workspace | Remembers which workspace you last selected when your account belongs to more than one. Purely a convenience — the active workspace is still authenticated server-side on every request. | Functional | 30 days |
| shopmcp.theme | Remembers the dashboard's light / dark / system preference across visits. | Functional | 365 days |
| shopmcp_li_fat_id | Stores LinkedIn's first-party ads click id when a LinkedIn campaign sends you to ShopMCP, so server-side conversion events can be attributed to the campaign. | Analytics | 90 days |
| shopmcp:linkedin-capi:website-visit:* | Session storage key that deduplicates the LinkedIn website-visit conversion event within the same browser session. | Analytics | Session |
| Smallchat / Firebase storage | Powers the support chat bubble and keeps the chat conversation available while visitors use the app. | Functional | Controlled by Smallchat and Firebase |
| __stripe_mid / __stripe_sid | Set by Stripe on the billing and checkout pages for fraud prevention. Only present while you are on a Stripe-rendered page; we do not set them ourselves. | Strictly necessary | __stripe_mid 365 days, __stripe_sid 30 min |
