# Storage disclosure

> Every key the widget can write to the shopper's browser, when, why and for how long, ready to copy into your CMP or cookie policy.

Source: https://shopassist.coec.dk/docs/widget/storage-disclosure · Updated 2026-10-01

The widget sets **no cookies**. It writes nothing before the shopper opens the chat. After that it uses only the keys below; any other key would be a bug. The table is generated from the widget's own storage inventory.

| Key | Storage | Written when | Purpose | Category | Before consent | Lifetime |
| --- | --- | --- | --- | --- | --- | --- |
| `shopassist:session` | sessionStorage | After POST /sessions, i.e. when the shopper opens the chat or accepts a proactive prompt | Continuity of the chat the shopper requested | strictly necessary | Yes | Tab session; token 24 h |
| `shopassist:ui` | sessionStorage | After the first open | UI state | strictly necessary | Yes | Tab session |
| `shopassist:lang` | sessionStorage | Only when the shopper explicitly picks a widget language | User-set UI choice for the tab | strictly necessary | Yes | Tab session |
| `shopassist:lang` | localStorage | Only when the shopper explicitly picks a widget language, while preferences consent = true | Keep the chosen widget language beyond the tab | preferences | No | 12 months from set_at |
| `shopassist:vid` | localStorage | Only while analytics consent = true, at session creation | Returning-visitor analytics, cross-session attribution | analytics | No | 13 months from created_at (not renewed) |
| `shopassist:attr` | localStorage | Only while analytics consent = true, once the conversation had a successful bot cart.* client action or a checkout.clicked | assisted_session attribution window | analytics | No | commerce.attribution_window_days (default 7, max 30) |
| `shopassist:trig` | localStorage | Only while preferences consent = true, when a trigger is shown | Frequency caps of proactive messages across pages | preferences | No | 30 days per entry |
| `shopassist:resume` | localStorage | Only while preferences consent = true and the session's identity level is guest, after POST /sessions | Continue the chat in a new tab | preferences | No | ≤ 24 h (session expiry) |
| `shopassist:dismissed` | sessionStorage | Only when the shopper explicitly dismisses a proactive bubble | User-interface customisation for the session (WP29 Opinion 04/2012 §3.6) | strictly necessary | Yes | Tab session |
| `shopassist:test_link` | sessionStorage | Only when the page URL carries a valid shopassist_preview test-link token (written by the loader) | The staff test of a staff_only widget | strictly necessary | Yes | Tab session; token 15 min |

Never stored on the device: identity tokens, confirmation tokens, verification codes, emails, message history and attribution-link state. `ShopAssist.shutdown({ forget: true })` deletes every key, for example on sign-out on a shared device.

The same table is on [shopassist.coec.dk/legal/cookies](/legal/cookies#widget-storage).