Cookies & local storage

Without these, checkout and sessions break.

• HttpOnly refresh cookies on the API host (for example the customer refresh cookie). The storefront cannot read them from JavaScript. They keep you signed in across reloads via /v1/auth/refresh.
• Guest cart token in localStorage so a logged-out basket survives a refresh.
• OAuth state, next path, and locale in sessionStorage only during Google / Facebook / Apple sign-in.

• spacepos.session_active and spacepos.scope in localStorage - UX hints only, not credentials.
• Guest shipping addresses in localStorage if you save addresses without an account.
• Favorite product IDs for guests.
• Affiliate referral id and visitor id in localStorage (default attribution window 30 days) when you arrive with a partner link.

Access tokens are kept in memory only and disappear on a full page reload (then refresh runs). We do not write passwords, OTPs, or full payment card numbers to localStorage.

If Sentry is configured, error reports may include technical data from the browser. We do not ship a separate marketing pixel suite on this storefront. Footer newsletter subscribe does not call an API yet (the form does not persist your email).

You can clear site data in the browser to drop guest cart, guest addresses, and affiliate ids. That will not revoke an HttpOnly refresh cookie; use Log out, or clear cookies for the API host as well.

When we add a consent banner or Do Not Sell control, this page will be updated to match the code.