ENCookie policy
COOKIE POLICY – AIORA Studio
Last updated: 19 October 2026
This policy is published by Profiles S.r.l., VAT IT07494910487, Via Marconi 30, 50131 Firenze, Italy. Questions: admin@aiorastudio.com. The privacy policy is at /privacy.
01Choice
1. How the choice works
Until you choose, only necessary cookies are used. Statistics and marketing stay off. You can accept all, reject all, or set the two switches. Closing the banner counts as reject. You can change the choice at any time from Cookie preferences in the footer.
The choice is stored in aiora_consent for 6 months. We also keep a record of it: an anonymous identifier, the policy version, the two flags, and the time. That record does not include your IP address or your account.
02Cookies
2. Cookies
| Name | Party | Category | Purpose | Duration |
|---|---|---|---|---|
| aiora_consent | First party | Necessary | Stores the choice: policy version, time, anonymous id, statistics flag, marketing flag. | 6 months |
| Clerk session | First party | Necessary | Sign-in session. Names and lifetimes are set by Clerk. | Clerk-managed |
| sidebar:state | First party | Necessary | Remembers whether the app sidebar is open. | 7 days |
| guest_token | First party | Necessary | HttpOnly session for a guest magic link. | 30 days |
| shopify_oauth_state | First party | Necessary | HttpOnly CSRF state for the Shopify connection. | 10 minutes |
| shopify_oauth_user | First party | Necessary | HttpOnly user id for the Shopify connection. | 10 minutes |
| mp_* | First party | Statistics | Mixpanel, only if the SDK falls back to a cookie. Written only after statistics consent. Deleted if you withdraw it. | Until you withdraw |
| _fbp | First party | Marketing | Meta browser id. Set only after marketing consent. Deleted if you withdraw it. | About 90 days |
| _fbc | First party | Marketing | Meta click id, only when an ad click id is present and marketing consent is on. Deleted if you withdraw it. | About 90 days |
03Storage
3. Similar technologies
These are not cookies. They are written only after statistics consent, and removed when you withdraw it.
| Name | Store | Category | Purpose | Duration |
|---|---|---|---|---|
| mp_<token>_mixpanel | localStorage | Statistics | Mixpanel device id and properties. No email. | Until you withdraw statistics |
| __mp_opt_in_out_<token> | localStorage | Statistics | Mixpanel opt-out flag, set when statistics consent is withdrawn. | Until the next opt-in |
| mp_sign_up_start | sessionStorage | Statistics | Stops the sign-up-start event from being sent twice in the same tab. | Until the tab closes |
| mp_signup_sent_<userId> | localStorage | Statistics | Stops the sign-up event from being sent twice. The value is the account id, not the email. | Until you withdraw statistics |
04Measurement
4. What each category loads
Statistics. Mixpanel (EU) and Vercel Analytics / Speed Insights. Vercel does not set a cookie. Both stay off until you allow statistics.
Marketing. The Meta pixel (fbevents.js). It does not load, and the _fbp / _fbc cookies are not set, until you allow marketing.