Cookie Policy
This policy lists the cookies and browser storage loving actually uses, and how you can control them. The short version:
- loving's own website, dashboard and sign-in pages use only first-party entries that are strictly necessary or remember a choice you made, plus one note about how you found us that is kept only if you accept a small notice. No analytics, no advertising, no third-party cookies.
- Storefronts ask every visitor before anything that is not strictly necessary: analytics (a persistent visitor identifier and order attribution) and marketing (advertising pixels and purchase conversions). Your choice can be changed at any time from "Cookie settings" in the store's footer.
loving's website, dashboard and sign-in hub
Cookies
| Cookie | Purpose | Duration |
|---|---|---|
| Strictly necessary. Keep you signed in to the dashboard, and to the sign-in hub where shoppers sign in to stores; the verifier protects a Google sign-in while it is in progress. | Until you close the browser or sign out |
| Remembers your interface language. | 1 year |
lastStoreSlug | Remembers your last-used store so dashboard links open the right one. | Until you close the browser |
sidebar_state | Remembers whether you keep the dashboard sidebar open or collapsed. | 7 days |
Browser storage
| Entry | Purpose | Duration |
|---|---|---|
loving:legal:pendingConsent | Carries the versions of the documents you accepted across the sign-in redirect, so your acceptance can be recorded. | Until sign-in completes, at most 1 hour |
| Hands the description you typed to the new-store page. | This tab |
loving:growth:firstTouch | Only if you accept the notice on our website: how you first reached us (campaign tags in the link, the referring site, the page you landed on). It holds no identifier, and is recorded once with your account if you sign up, then cleared. | Up to 30 days |
loving:growth:firstTouchConsent | Your answer to that notice — yes or no — so it is not asked again. | About 6 months |
loving:growth:pendingCode | Strictly necessary for an offer you followed a link for: the referral or offer code, so it can be applied when you sign up. | Up to 7 days |
| Counts a visit to a referral or offer link once per tab. | This tab |
| Remember how you like dashboard lists shown (table, graph, map…). | Until you clear it |
assistant-panel-width | Remembers the width of the assistant panel. | Until you clear it |
| Remembers the period you picked in Analytics. | This tab |
lv.clock | Remembers whether you type times on a 12- or 24-hour clock. | Until you clear it |
finance:opening-dismissed:{store} | Remembers that you dismissed the Finance set-up card. | Until you clear it |
| Studio preferences, such as the open panel and recently used fonts. | Until you clear it |
| An autosave draft of your Studio canvas, so unsaved work survives a reload. Cleared when you save or discard. | Until saved or discarded |
The sign-in pages also write and immediately delete a test entry to check that your browser allows storage.
Storefronts
Each store hosted by loving runs on its own address, and everything below is kept for that address only — never shared across stores.
How a storefront asks
On your first visit a storefront asks about two categories:
- Analytics — a persistent visitor identifier, so the store can recognise returning visitors, follow a visit through to checkout, and attribute orders to the campaigns and ad clicks that brought them.
- Marketing — advertising pixels from Meta, TikTok, Pinterest, Google or Snapchat that the merchant connects, and purchase conversions loving sends to the same networks from its servers, with your email address and phone number hashed.
Until you choose, the store counts page views with a temporary identifier held only in the open page's memory, together with campaign tags in the link and the referring site's address. It stores no identifier in your browser and records no ad-click identifiers.
Your choice is kept in your browser (sf_mkt_consent, holding the
version of the question, your two answers and when you gave them) for 12
months, after which you are asked again. A record of it is also kept on our
servers for 13 months as proof. You can change it at any time from the
Cookie settings link in the footer of every store; withdrawing is as easy
as agreeing. Each order also keeps the answer given in the browser it was
placed from, whether that browser sent a Global Privacy Control signal, and
the country it was seen from, for as long as the order is kept.
Signals we respect. A browser that sends a Global Privacy Control signal is treated as refusing marketing. Storefronts pass your answer to Google tags through Google Consent Mode, so they behave accordingly. Server-side purchase conversions are sent only for orders whose visitor agreed to marketing, and never when the browser the order was placed from refused it or sent a Global Privacy Control signal — even if you agreed on another device.
Where you are asked. By default every visitor is asked. A merchant may choose to ask only visitors in the European Economic Area, the United Kingdom and Switzerland. Elsewhere, analytics and marketing then run until you decline, and the store always shows the control to decline.
Cookies
| Cookie | Purpose | Duration |
|---|---|---|
sf_locale | Remembers the language you chose for that store. | 1 year |
Advertising pixels set their own cookies once you agree to marketing — for
example Meta's _fbp and _fbc, TikTok's _ttp, Pinterest's _pin_unauth,
Google's _gcl_au and Snapchat's _scid — under those platforms' own
policies. None of them load before you agree.
Browser storage
| Entry | Category | Purpose | Duration |
|---|---|---|---|
storefront:cart:{store} | Necessary | An anonymous cart token, so your cart survives a reload. | Until checkout or cleared |
| Necessary | Your sign-in session at that store, kept in its own storage (not cookies) so it is isolated from every other store. | Until you sign out |
| Necessary | A sign-in in progress, and the action (such as adding to cart) to finish once you are back. | This tab |
be_support_guest:{store} | Necessary | Lets you return to a chat you started as a guest, when the store allows guest chat. | Until cleared |
storefront:legal:{store} | Necessary | From older stores' sign-in: the document versions you accepted, until the sign-in is recorded. | At most 1 hour |
sf_mkt_consent | Necessary | Your answer to the store's analytics and marketing question. | 12 months |
sf_mkt_consent_rec | Necessary | Notes that your answer has already been recorded on our servers, so it is recorded once rather than on every page. | As long as your answer |
storefront:units:{store} | Preference | Your language and measurement units (cm or inches) for that store. | Until cleared |
| Counting | Which of the store's event promotions you have seen in this tab, so each is counted once per visit. Holds no identifier. | This tab |
sf_vid | Analytics | A pseudonymous visitor identifier: counts returning visits, page and product views, cart and checkout steps, and which campaign or ad brought you. Linked to a person only if they sign in or place an order; the events are kept for 180 days by default. | Until you clear it or change your choice |
| Analytics | Group those events into one visit; a visit ends after 30 minutes without activity. | This tab |
The store's own design may keep a few more choices of the same kind in
your browser — the market (country and currency) you picked (for example
market: followed by the store's handle, or the design's name followed by
-market:), an announcement bar you closed (…-announce-hidden), a gift-card
message while you write it (….giftDraft, kinetic-gift: with the store's
handle), or how a product list is laid out (listing:density,
…:listing-view). They remember choices you made and are not used to track
you.
Third-party services
- Payments. When you pay — a merchant subscribing to loving, or a shopper checking out — payment pages and embedded payment components are provided by Stripe, which may set its own cookies for fraud prevention and security under its own policies.
- Google sign-in. A merchant who signs in with Google uses Google's own pages and cookies.
- Bot protection. When a store allows guest chat, Cloudflare Turnstile checks the browser before a guest can write.
- Fonts. Storefronts and loving's website load web fonts from loving's own address — we fetch them from Google Fonts on our side — so your IP address is not sent to Google when a page loads.
- Videos. A video embedded in a store page (YouTube through youtube-nocookie.com, or Vimeo with its "do not track" setting) loads only after you click it; from then on that platform's own policy applies.
- Maps. The dashboard's maps load tiles from OpenFreeMap, which receives your IP address when they load.
Managing cookies and storage
On a storefront, use the Cookie settings link in its footer. Everywhere, you can also clear or block cookies and site data in your browser settings. Blocking the necessary entries above will sign you out, reset your language choice or empty an anonymous cart. Clearing a storefront's storage also resets its visitor identifier and your answer to its question, so you will be asked again.
Changes
If we add a cookie or storage entry, we update this policy before using it, and ask for consent first wherever the law requires it.