Our website: why there is no cookie banner
shopassist.coec.dk loads no third-party scripts, no advertising pixels and no analytics that store anything on your device. We measure visits from server logs without IP addresses. The only storage is strictly necessary or set by your own choice, so no consent banner is needed.
| Name | Type | Where | Set when | Purpose | Category | Lifetime |
|---|---|---|---|---|---|---|
| __Host-sa_session | cookie (HttpOnly, Secure, SameSite=Lax, Path=/) | /app, /api | on sign-in | authentication | strictly necessary | server-side: 7 days idle / 30 days absolute |
| __Host-sa_oauth | cookie (HttpOnly, Secure, SameSite=Lax) | Google sign-in | Google sign-in start | OAuth state | strictly necessary | 10 minutes |
| theme | localStorage | docs, dashboard | the user picks a theme | user-set UI customization | strictly necessary | until changed |
| sa:inbox_sound | localStorage | dashboard | the user enables the inbox sound | user-set UI preference | strictly necessary | until changed |
| sa:dismissed:<banner_id> | localStorage | dashboard | the user dismisses a dismissable banner | user-set UI preference | strictly necessary | until changed |
| sa:billing_ctx | sessionStorage | dashboard | right before a redirect to Stripe Checkout or the Portal | returns the user to the page they came from | strictly necessary | tab session; removed on return |
| sa:support_session | sessionStorage | dashboard (operators only) | an operator starts a support session | support access | strictly necessary | tab session |
| Widget keys | see the widget storage table | / and /demo | only after the visitor opens the demo chat | the requested chat (COEC is controller) | as published | as published |
Nothing on this list is written on our marketing pages unless you open the demo chat or choose a theme in the docs.
The chat widget in stores
The ShopAssist widget stores nothing on a shopper's device until the shopper opens the chat or accepts a proactive message. It then stores only what the chat needs, and further keys only with the matching consent from the store's consent banner. Merchants can copy this table into their own cookie policy and consent tool.
| Name | Type | Set when | Purpose | Category | Before consent | Lifetime |
|---|---|---|---|---|---|---|
| shopassist:session | sessionStorage | After POST /sessions, i.e. when the shopper opens the chat or accepts a proactive prompt | Continuity of the chat the shopper requested | strictly necessary | Yes | Tab session; token 24 h |
| shopassist:ui | sessionStorage | After the first open | UI state | strictly necessary | Yes | Tab session |
| shopassist:lang | sessionStorage | Only when the shopper explicitly picks a widget language | User-set UI choice for the tab | strictly necessary | Yes | Tab session |
| shopassist:lang | localStorage | Only when the shopper explicitly picks a widget language, while preferences consent = true | Keep the chosen widget language beyond the tab | preferences | No | 12 months from set_at |
| shopassist:vid | localStorage | Only while analytics consent = true, at session creation | Returning-visitor analytics, cross-session attribution | analytics | No | 13 months from created_at (not renewed) |
| shopassist:attr | localStorage | Only while analytics consent = true, once the conversation had a successful bot cart.* client action or a checkout.clicked | assisted_session attribution window | analytics | No | commerce.attribution_window_days (default 7, max 30) |
| shopassist:trig | localStorage | Only while preferences consent = true, when a trigger is shown | Frequency caps of proactive messages across pages | preferences | No | 30 days per entry |
| shopassist:resume | localStorage | Only while preferences consent = true and the session's identity level is guest, after POST /sessions | Continue the chat in a new tab | preferences | No | ≤ 24 h (session expiry) |
| shopassist:dismissed | sessionStorage | Only when the shopper explicitly dismisses a proactive bubble | User-interface customisation for the session (WP29 Opinion 04/2012 §3.6) | strictly necessary | Yes | Tab session |
| shopassist:test_link | sessionStorage | Only when the page URL carries a valid shopassist_preview test-link token (written by the loader) | The staff test of a staff_only widget | strictly necessary | Yes | Tab session; token 15 min |
Stores are the controllers of their shoppers' data and decide which consent categories apply in their store.