Cookies
Effective date: [OWNER: effective date]
In short
- We use cookies and similar browser storage to keep you signed in, remember settings and run the products on a merchant storefront.
- We do not use advertising cookies and we do not sell or share cookie data for advertising.
- If you visit from the European Economic Area, the United Kingdom or Switzerland, we ask before we set the one non-essential cookie on this website.
What this page covers
It lists every cookie, local storage and session storage entry that our website, our merchant app and our storefront scripts set. Freebies Engine by Log Studio Lab and Experiment Engine by Log Studio Lab run on a merchant's Shopify store. On that store the merchant is responsible for the store's own cookie notice, and we act for the merchant as described in our privacy policy.
We do not use advertising pixels or social media trackers. The public marketing pages load Google Tag Manager and Google Analytics, which set the analytics cookies below only if you allow them where the law asks. Page views and field performance of this website are measured with Vercel Web Analytics and Speed Insights, which do not use cookies and receive page paths with query strings removed.
This website and the merchant app
| Name | Type | Set by | Purpose | Lasts | Category |
|---|---|---|---|---|---|
__session, __client_uat | Cookie | Clerk (merchant app and sign-in pages) | Keeps a merchant signed in and tells the website whether to show Sign in or Open app. Not set for visitors who never sign in. | Session token refreshed about every minute; the sign-in lasts as long as the Clerk session settings allow [OWNER: confirm the production session length] | Essential |
mlf_plan | Cookie | This website | Remembers the plan you clicked on the pricing page so sign-up can continue with it. | 1 hour | Essential |
__Host-mlf_oauth, __Host-mlf_launch, __Host-mlf_claim (the same names ending _testing for the second product) | Cookie | This website (HttpOnly, signed) | Protects the Shopify install and sign-in handshake against forgery and lets an install continue after sign-up. | 10 minutes (oauth); 30 minutes (launch and claim) | Essential |
mlf:theme | Local storage | This website | Remembers light or dark mode if you choose one. | Until you clear it or go back to the system setting | Preference |
mlf:sidebar, mlf:shortcuts, mlf:recent:<username>, mlf:dismiss:<key>, freebies:editor:preview-collapsed, freebies.analytics.range | Local storage | Merchant app | Remember interface choices: collapsed sidebar, keyboard shortcuts on or off, recent items in the command palette, dismissed banners, the editor preview and the analytics date range. | Until you clear it | Preference |
mlf:editor:create:<shop>:<template> | Session storage | Merchant app | Keeps an unsaved new offer if the tab reloads. | Until the tab closes | Preference |
mlf_geo | Cookie | This website | Set only for visitors in the European Economic Area, the United Kingdom or Switzerland, from the country your request comes from, so we know to ask before setting mlf_ft. Holds the value eu and nothing about you. | 1 day | Essential |
mlf_consent | Cookie | This website | Remembers your answer in the cookie banner (all or essential only). | 6 months | Essential |
mlf_ft | Cookie | This website | First-touch attribution: records the campaign parameters or referring site of the first visit (never your identity) so we can tell which channels lead to installs. Read once when you install. Set only after you accept in the cookie banner if you are in the European Economic Area, the United Kingdom or Switzerland; elsewhere it is set on your first visit unless you reject it. | 30 days | Analytics |
_ga, _ga_<container id> | Cookie | Google Tag Manager and Google Analytics (this website) | Tell visits and visitors apart so Google Analytics can measure how the website is used. Loaded only on the public marketing pages. In the European Economic Area, the United Kingdom and Switzerland, nothing is stored until you choose Accept; Google Consent Mode keeps these tags in a denied state until then. | Up to 2 years | Analytics |
On a merchant storefront
These are set by the scripts a merchant turns on in their store. The shopper's privacy choice in Shopify's customer privacy banner applies: the analytics entries below are not created, and the analytics events are not sent, if the shopper has not allowed analytics.
| Name | Type | Set by | Purpose | Lasts | Category |
|---|---|---|---|---|---|
promo_engine_utm_landing, promo_engine_link_params | Local storage | Storefront script of Freebies Engine by Log Studio Lab | Keep the landing path, utm parameters and the offer link parameter so a promised discount still applies at checkout. Emails and advertising click ids are dropped. | 24 hours for the landing; link parameters until cleared | Essential |
promo_engine_cart_id | Local storage | Storefront script of Freebies Engine by Log Studio Lab | Remembers the cart used by the gift and bundle widgets. | Until cleared | Essential |
promo_engine_declined_gifts, promo_engine_gift_slider_auto_opened_v2, promo_engine_migrated_line_keys, promo_engine_qualified | Session storage | Storefront script of Freebies Engine by Log Studio Lab | Stop a gift the shopper declined from being added again, avoid reopening the gift slider, and avoid repeating cart updates and qualified-cart counts. | Until the tab closes | Essential |
promo_engine_session_id | Session storage | Storefront script of Freebies Engine by Log Studio Lab | A random id for this browsing session that groups the offer events of the visit. It is not linked to a name or email. | Until the tab closes | Essential |
_ml_vid | Cookie | Storefront script of Experiment Engine by Log Studio Lab | A random visitor id so a visitor keeps seeing the same variant of a test. Created only after the shopper allows analytics through Shopify's customer privacy settings. | 1 year | Analytics |
_ml_new | Session storage | Storefront script of Experiment Engine by Log Studio Lab | Marks whether the visitor id was created in this session, to tell new visitors from returning ones. | Until the tab closes | Analytics |
_ml_pixel | Local storage | Web pixel of Experiment Engine by Log Studio Lab (in Shopify's pixel sandbox) | Remembers which test variants the visitor is in so page, cart and order events can be tied to them. Written only with analytics consent. | Until cleared | Analytics |
The web pixels that report storefront events run inside Shopify's sandbox. They set no cookies of their own and never send a customer id. The Freebies Engine by Log Studio Lab pixel sends a random per-page-load session id and the cart token with the page path (and campaign parameters), product, cart and checkout events. The Experiment Engine by Log Studio Lab pixel sends the random visitor id and test versions it was told by the storefront script, with the page path (without any query), product ids, and order ids, only after the shopper allows analytics.
Consent
Essential entries are needed for sign-in, security or to do what you asked, so we set them without asking. Preference entries only remember interface choices you make on this website and in the app.
The non-essential cookies on this website are mlf_ft and the Google Analytics cookies _ga and _ga_*. If you visit from the European Economic Area, the United Kingdom or Switzerland, we show a cookie banner on your first visit and do not set them unless you choose Accept. Accept, Reject and Settings carry the same weight. Elsewhere it is set on your first visit and we do not show the banner. If you reject, nothing else changes: you can use the whole website and install the app.
Your answer is remembered in the mlf_consent cookie for six months. To know whether to ask, the cookie mlf_geo is set for visitors in those regions, from the country of your request. You can change your choice at any time with the Cookie settings link in the footer of every page on this website; rejecting stops them being set.
How to control them
Every major browser lets you block or delete cookies and site storage. If you block essential entries, sign-in and the app will not work. Shoppers can change their analytics choice in the privacy banner a merchant's store shows, or by clearing the site data of that store.