Cookie Policy

Introduction

shiponline.app uses a small number of cookies and similar technologies to keep you signed in, remember your interface preferences, understand aggregate usage of the Service, and - unless you opt out - measure and serve our advertising. This Policy supplements our Privacy Notice; the Notice describes how we handle personal information generally, while this Policy focuses on the browser-side technologies that store and retrieve information on your device.

What cookies are

A cookie is a small text file that a website places in your browser’s local storage. When your browser later returns to the same website - or, in some cases, another website that the first one has embedded - the cookie is sent back so the site can recognise the browser. Cookies typically contain a short identifier and an expiry date, and can be read only by the domain that set them (or by a domain that shares authentication with it).

Similar technologies - for examplelocalStorageentries,sessionStorageentries, and pixel tags - perform comparable functions and are covered by this Policy where we use them.

Categories of cookies we use

Cookies are typically grouped into four categories. We use all four; you can opt out of the advertising category at any time (see below).

Strictly necessary

Required for the Service to work. Disabling this category will break sign-in and most Service features.

• The sign-in session cookie set by our authentication layer (NextAuth) so you remain signed in across page loads;
• A CSRF token cookie that protects against cross-site request forgery on the actions you submit;
• Short-lived cookies set by our payment processor (Stripe) when you enter a payment method so the payment flow can complete securely.

Functional

Remember interface preferences you have chosen. Disabling this category is fine; the Service still works but small preferences will not persist between visits.

• The last date range you picked on Analytics, the sort order on the /orders table, whether you have dismissed a coach-mark, the collapsed/expanded state of dashboard panels, and other small state that improves the interface between visits. These are stored in your browser’s localStorage (a similar technology covered by this Policy), not in cookies.

Performance and analytics

Help us understand how the Service is used in aggregate.

• The marketing website (shiponline.app) uses Plausible Analytics, which is configured cookieless - it does not set cookies and does not use browser storage to identify visitors across sessions.
• The dashboard uses Vercel Speed Insights and Vercel Analytics, which are also cookieless - they do not set cookies to identify visitors across sessions.
• We set a small set of first-party attribution cookies (named below) that record an anonymous ID, the campaign or ad you arrived from (including a Google Ads click identifier), and any referral code, so we can see which channels bring visitors and credit referrals.

Advertising and measurement

The marketing website (shiponline.app) uses Google Ads to measure the results of our advertising and to show our own ads to past visitors (remarketing). You can opt out of these cookies at any time by declining on our cookie banner, and they are never set when your browser sends a Global Privacy Control signal. The section below describes them and your choices.

Advertising and measurement

The marketing website uses Google Ads to measure conversions (for example, when a visit leads to a purchased label) and for remarketing (showing our own ads to people who have visited the site). This involves Google setting cookies and similar identifiers and receiving information about your interaction with the site.

Your control. You can opt out of these advertising and measurement cookies at any time by selecting Declineon our cookie banner; the opt-out is remembered across the Service (including my.shiponline.app), and you can reset a prior choice by clearing this site’s storage in your browser. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a standing opt-out and do not set these cookies regardless of any banner choice.

Third parties that may set cookies

The following third parties may set cookies on your device when you interact with specific parts of the Service. Each third party’s use of cookies is governed by its own cookie/privacy policy; we describe here only what the cookies do in the context of the Service.

• Stripe- sets short-lived cookies to protect the payment flow from fraud when you enter a payment method to buy a label. See Stripe’s cookie policy at stripe.com/cookies-policy/legal.
• Google Maps Platform (Places API) - powers address autocomplete on sender and recipient input fields. Google may set cookies during autocomplete requests as part of its own fraud and abuse controls. See policies.google.com/technologies/cookies.
• Google Ads- unless you opt out (banner Decline or a GPC signal), Google sets cookies to measure ad conversions and to show you our remarketing ads on other sites. Governed by Google’s policies at policies.google.com/technologies/cookies.

Of these, only Google Ads sets advertising cookies, and never when you have opted out on the cookie banner or via GPC. Stripe and Google Maps Platform set only the operational cookies described above.

Named cookies we set

The following list identifies the first-party cookies we set by name, purpose, and typical lifetime. Third-party cookies (e.g. Stripe, Google) are listed by the third party and named according to their own conventions - see the third-party pages linked above for their names and lifetimes.

• __Secure-authjs.session-token - strictly necessary; holds an encrypted, HTTP-only reference to your active sign-in session; typical lifetime up to 30 days, refreshed on activity.
• __Host-authjs.csrf-token - strictly necessary; short-lived CSRF token used to protect form submissions; expires with the session.
• ship_consent - strictly necessary; remembers the choice you made on the cookie banner (accepted or declined) so the Service, including the app at my.shiponline.app, can honour it without asking again; lifetime 12 months.
• ship_anon - analytics; a random anonymous ID used to count visits and, if you later sign up, connect your pre-signup activity to your account; lifetime 12 months.
• ship_ft and ship_lt - analytics; record the campaign parameters (UTM tags) on the link that first brought you to the Service and on the most recent one; lifetimes 90 and 30 days.
• ship_ref - analytics; stores the referral code from a link you arrived on so we can credit the referrer; lifetime 90 days.
• ship_gads- analytics/attribution; if you arrive from one of our ads or from a campaign-tagged link, records that click’s identifiers and campaign details - the Google click identifier (gclid, or gbraid / wbraid on some Apple devices), the ad’s campaign and keyword, any UTM campaign tags on the link, the page you landed on, and the time of capture - so we can credit which ad or campaign brought you if you sign up or buy a label. A later tagged click replaces the stored one; first-party, set on arrival, lifetime 90 days.
• ship_out- attribution; if you arrive from a link in an email we sent you, stores that link’s reference token so we can connect your visit to our earlier email if you sign up; first-party, set on arrival, lifetime 90 days.
• ship_vol - attribution/preference; if you use the shipping-volume selector, stores the volume range you chose so we can carry that answer into your account if you sign up; first-party, set on interaction, lifetime 90 days.
• _gcl_au and related Google Ads cookies - advertising; set by Google Ads unless you opt out, to measure ad conversions and support remarketing. The conversion-linker cookie (_gcl_au) has a typical lifetime of 90 days; remarketing cookies are set on Google’s own domains under its policies. None are set if you decline on the cookie banner or send a GPC signal.

Cookie terminology

• First-party cookies - cookies set by the shiponline.app domain that you are visiting.
• Third-party cookies - cookies set by a domain other than shiponline.app during an interaction with an embedded third-party service, such as Stripe or Google Maps Platform.
• Session cookies - expire when you close your web browser.
• Persistent cookies - stay on your device for a set period or until you delete them; used for sign-in refresh and interface-preference persistence between visits.
• HTTP-only cookies - flagged so JavaScript running on the page cannot read them; used for authentication cookies to reduce the impact of any cross-site scripting vulnerability.
• Secure cookies - flagged so they are only sent over HTTPS connections; all cookies we set are marked secure.

Controlling and disabling cookies

Most browsers let you view, delete, and refuse cookies. Instructions vary by browser:

• Chrome - Settings → Privacy and security → Cookies and other site data;
• Safari - Settings → Privacy → Manage Website Data;
• Firefox- Settings → Privacy & Security → Cookies and Site Data;
• Edge - Settings → Cookies and site permissions.

You can also open a private / incognito window, which typically discards cookies at the end of the session. For general information about cookies and how to manage them, see aboutcookies.org or allaboutcookies.org.

Do Not Track and Global Privacy Control

Some browsers can send a Do Not Track (DNT) header to the websites you visit. There is no industry-standard interpretation of the DNT header, so we do not rely on it. For advertising and measurement cookies we use an explicit banner choice plus the Global Privacy Control signal (below) instead.

We honour the Global Privacy Control (GPC) signal. We treat GPC as a request to opt out of any “sale” or “sharing” of personal information under the applicable state privacy laws. In practice, when your browser sends GPC we keep the Google Ads advertising and measurement cookies switched off - they are not set even if our cookie banner was accepted. We do not sell personal information for money.

Changes to this Policy

We may update this Policy from time to time. When we do we will update the effective date at the top of this page. Material changes will be notified through the Service or by email at least fifteen (15) days before they take effect.

Contact us

Questions or concerns about this Policy can be sent to support@shiponline.app. We aim to reply within one business day.