| better-auth.session_token | Signs a logged-in session. Without it, the dashboard cannot remember who you are between requests. | Strictly necessary | Session, renewed for up to 30 days |
| better-auth.csrf_token | Cross-site request forgery defence. Pairs with the session cookie so we can reject requests that did not originate from the dashboard. | Strictly necessary | Session |
| shopmcp_analytics_consent | Records whether you accepted or declined optional analytics so we can honour that choice across ShopMCP subdomains. | Strictly necessary | 365 days |
| shopmcp_ads_measurement_consent | Records whether you allowed or declined optional ads measurement across ShopMCP subdomains. | Strictly necessary | 365 days |
| shopmcp_ads_consent_subject | Random first-party identifier for the ads measurement choice you made. A fresh one is issued when you explicitly accept again. | Ads measurement | Up to 365 days, cleared on withdrawal |
| shopmcp_ads_consent_grant | Signed, HttpOnly proof of your current ads measurement choice. ShopMCP checks its server-side status before keeping an ad click or linking it to a workspace. | Ads measurement | Up to 365 days, cleared on withdrawal |
| shopmcp_ads_attribution | Signed first-party ad click identifier and campaign tags, stored only after ads measurement consent and linked to your workspace when onboarding completes. | Ads measurement | Up to 90 days |
| shopmcp_ads_workspace | Signed workspace link that lets us withdraw ads attribution and suppress pending conversions from the same browser even after you sign out. | Ads measurement | Up to 90 days |
| _gcl_* | Google advertising click measurement identifiers, permitted only when you accept ads measurement. | Ads measurement | Google tag expiry, up to 90 days |
| shopmcp:google-ads:trial:sent:* | First-party local storage that helps avoid reporting the same confirmed trial twice from this browser. It contains an opaque conversion identifier, not your email or store data. | Ads measurement | Until ads measurement is withdrawn or browser storage is cleared; old entries are removed after 400 days on a later visit |
| _ga / _ga_<container-id> | Google Analytics pseudonymous browser and session identifiers. Set only after you accept analytics; never used to send connected-store data or email-bearing URLs. | Analytics | Up to 2 years |
| shopmcp:ga4:* | First-party local storage used after consent to prevent duplicate onboarding, integration, first-result, trial, and purchase events. Events waiting for your choice are held only in page memory, not browser storage. | Analytics | 30 to 400 days |
| shopmcp.active_workspace | Remembers which workspace you last selected when your account belongs to more than one. Purely a convenience — the active workspace is still authenticated server-side on every request. | Functional | 30 days |
| shopmcp.theme | Remembers the dashboard's light / dark / system preference across visits. | Functional | 365 days |
| shopmcp_li_fat_id | Stores LinkedIn's first-party ads click id when a LinkedIn campaign sends you to ShopMCP, so server-side conversion events can be attributed to the campaign. | Analytics | 90 days |
| shopmcp:linkedin-capi:website-visit:* | Session storage key that deduplicates the LinkedIn website-visit conversion event within the same browser session. | Analytics | Session |
| Smallchat / Firebase storage | Powers the support chat bubble and keeps the chat conversation available while visitors use the app. | Functional | Controlled by Smallchat and Firebase |
| __stripe_mid / __stripe_sid | Set by Stripe on the billing and checkout pages for fraud prevention. Only present while you are on a Stripe-rendered page; we do not set them ourselves. | Strictly necessary | __stripe_mid 365 days, __stripe_sid 30 min |
