Marketplace document
Cookie policy
Information about necessary cookies, granular consent and conversion measurement on MDStore.
Storage technology inventory
| Technology / provider | Category and purpose | Storage and duration | Activation and control |
|---|---|---|---|
| mdstore_session / mdstore_admin_session · MDStore | Strictly necessary: authentication | cookie · HttpOnly, SameSite=Lax, Secure (production) · 7 days | When using the requested function; managed through account/browser |
| mdstore-language · MDStore | Strictly necessary: requested language | cookie · 1 year; localStorage · until cleared or your choice changes | When using the requested function; managed through account/browser |
| mdstore-theme · MDStore | Strictly necessary: explicitly selected theme | localStorage · until cleared or your choice changes | When using the requested function; managed through account/browser |
| cookie-consent · MDStore | Strictly necessary: categories, date and consent version | localStorage · at most 180 days; renewed when the version changes | When using the requested function; managed through account/browser |
| mdstore-ai-support-chat · MDStore | Strictly necessary: last 10 AI-support messages | sessionStorage · until the tab session ends | When using the requested function; managed through account/browser |
| mdstore-pwa-installed / mdstore-pwa-install-dismissed-v2 / Cache Storage · MDStore | Strictly necessary: offline static resources and installation choice | localStorage: until cleared or your choice changes; Cache Storage: until a new cache version or clearing | When using the requested function; managed through account/browser |
| Clerk / Google sign-in | Strictly necessary: authentication | cookie: depends on provider configuration; no single lifetime has been confirmed | When using the requested function; managed through account/browser |
| mdstore-recent-searches · MDStore | Preferences: up to 5 recent searches | localStorage · until cleared or your choice changes | After category consent; withdraw through Cookie settings |
| _ga / _ga_* · Google Analytics 4; GTM-WKMB49K9 / G-4HY9TNREVF | Analytics: usage and campaign measurement | cookie: depends on provider configuration; no single lifetime has been confirmed | After category consent; withdraw through Cookie settings |
| mdstore-listing-analytics · MDStore | Analytics: usage and campaign measurement | sessionStorage · until the tab session ends | After category consent; withdraw through Cookie settings |
| Vercel Analytics / MDStore events | Analytics: usage and campaign measurement | technical storage: depends on provider configuration; no single lifetime has been confirmed | After category consent; withdraw through Cookie settings |
| _fbp / _fbc · Meta Pixel 5535458020013357 | Marketing: usage and campaign measurement | cookie: depends on provider configuration; no single lifetime has been confirmed | After category consent; withdraw through Cookie settings |
Providers manage their own technologies; the site cannot remove HttpOnly or other-domain cookies.
Section 1
Opening an invitation sets the signed functional HttpOnly mdstore_referral cookie for up to 30 days (SameSite=Lax, Secure in production), solely to attribute the requested referral reward. Service top-ups open PayPal separately after confirmation, under its own technology policy. The wallet page is private and excluded from Analytics and advertising.
Section 2
With the relevant consent, we measure public visits lasting at least 30 seconds, newly created accounts, new creator applications and PWA interactions. Clicks, accepted prompts, browser installation confirmations and app opens are separate events. mdstore-engagement stores a random session and contact-free UTM attribution in sessionStorage with a 30-minute inactivity timeout. Optional mdstore-measurement-consent and mdstore-registration-receipt cookies and mdstore-registration-measurement sessionStorage last up to 10 minutes, forwarding account-free confirmations on the next public page. CRM and Google receive events only with Analytics consent; Meta requires Marketing consent. Measurement records older than one year are deleted in batches during later collections. These tools do not load on private pages.
Section 3
Cookies and localStorage/sessionStorage store information on your device. Change consent through Cookie settings in the footer. Rejecting Analytics, Marketing or Preferences does not block browsing or creator contact.
Section 4
Necessary: mdstore_session and mdstore_admin_session authenticate local sessions (up to 7 days, HttpOnly, SameSite=Lax, Secure in production). mdstore-language stores the requested language (cookie: 1 year). Clerk and the social sign-in you choose use their own technologies for requested access. Light mode is default; mdstore-theme stores an explicitly chosen theme until changed or cleared.
Section 5
cookie-consent stores categories, version and choice time in localStorage for up to 180 days or a version renewal. Without storage access, consent remains only in the open document. mdstore-ai-support-chat keeps the last 10 messages in sessionStorage until the tab closes or data is cleared. PWA indicators and static caches remember installation choices and offline assets; private pages are not cached by the PWA.
Section 6
Optional Preferences: mdstore-recent-searches stores up to five recent searches only with consent and is removed on withdrawal. Requested language and account access do not depend on it.
Section 7
Optional Analytics: internal MDStore events, Vercel Analytics and GTM-WKMB49K9 with GA4 G-4HY9TNREVF run only after consent. Google may use _ga/_ga_*; actual duration depends on property settings. A random mdstore-listing-analytics sessionStorage identifier starts only with consent and is removed on withdrawal or tab closure. It helps deduplicate views and clicks; server hashes are kept up to two days and daily aggregates up to 90 days. Statistics contain no phone, email, IP or message text and do not confirm conversations or sales.
Section 8
Optional Marketing: Meta Pixel 5535458020013357 loads fbevents.js only after Marketing consent for public-page visits. It may use _fbp/_fbc and send page URLs and technical data to Meta. Form fields are not supplied and advanced matching is not configured. Private pages and search are excluded. Marketing consent does not enable Analytics.
Section 9
There is no public artwork checkout and the catalog loads no PayPal SDK. Separate PayPal Sandbox tests are administrator-only and use the provider's own technologies. Contact links open external services at the visitor's request, under their respective rules.
Section 10
Withdrawal stops optional loading and clears known storage and cookies accessible to the site. MDStore scripts cannot remove HttpOnly or other-domain cookies; use browser or provider settings.