What We Put
On Your Device
Some cookies keep your cart working and can't be switched off. The rest measure the site and run our ads — those are yours to refuse.
Cart, login, checkout, fraud checks.
Region, currency, order tracking.
Which pages work, which don't. Includes session replay.
Ad measurement, audiences, email and cart reminders.
What counts as a cookie
A cookie is a small text file a site stores on your device. We also use pixels, tags, local storage and SDKs — this page calls all of them cookies, because the distinction matters to engineers and not to you.
Names and lifespans are set by the providers, not by us, and they change. The tables below cover the main ones, not every last item.
Session recording
Microsoft Clarity records how you move through the site — mouse movement, scrolling, clicks and taps, replayed to us as an anonymised session, plus heatmaps. We use it to find the button nobody can see and the checkout step where everyone gives up. It isn't watched live and it isn't tied to your name.
Text you type into forms is masked, and payment details never reach it — checkout runs on Shopify's own infrastructure. We can't see your card number and neither can Clarity.
Microsoft is a joint controller for this data. See the Microsoft Privacy Statement.
The cookies themselves
Necessary and functional — always on
| Who | Examples | What it does / how long |
|---|---|---|
| Shopify |
cart checkout_token
|
Holds your cart through to checkout. Up to 2 weeks. |
| Shopify |
_secure_session_id secure_customer_sig
|
Secure session, keeps you signed in. Session to 1 year. |
| Shopify |
_tracking_consent localization
|
Remembers your cookie choices, region and currency. 1 year. |
| ParcelPanel | Tracking cookies | Runs the order tracking page. Session to 1 year. |
Analytics — optional
| Who | Examples | What it does / how long |
|---|---|---|
| Shopify |
_shopify_y _shopify_s
|
Store analytics — visits, sessions, traffic sources. 30 min to 1 year. |
| Google Analytics |
_ga _gid
|
Counts visitors and pageviews, maps journeys. 24 hours to 2 years. |
| Microsoft Clarity |
_clck _clsk MUID
|
Session replay and heatmaps, as in section 02. 1 day to 1 year. |
Marketing — optional
| Who | Examples | What it does / how long |
|---|---|---|
| Meta |
_fbp fbc
|
The Meta Pixel — did an ad lead to a purchase, and audience building. Around 3 months. |
| Klaviyo | __kla_id |
Links your email sign-up to your browsing for relevant email and cart reminders. Up to 2 years. |
Meta and Google may combine what they collect here with data from other sites you visit. That is how ad networks work and it's worth knowing. Their policies govern it: Meta, Google, Klaviyo, Shopify.
Turning them off
In your browser
Every major browser can block or delete cookies, and most can block third-party cookies while leaving your cart intact. Settings → Privacy. Blocking everything will break checkout — that isn't us being awkward, it's how carts work.
At the source
- Google Analytics — the opt-out add-on works across every site you visit.
- Meta — your ad preferences.
- Microsoft Clarity — Microsoft's own privacy controls.
- Klaviyo email — the unsubscribe link works immediately and we don't make you explain yourself.
Global Privacy Control
If your browser sends a GPC signal we treat it as an opt-out of the sale or sharing of personal information wherever the law recognises it. You don't need to tell us separately.
Transfers, rights, changes
Most of these providers are US-based, so data collected through these cookies may be processed in the United States. Those transfers rely on the safeguards each provider has in place, described in the policies linked above.
Depending on where you live you can access, correct or delete the data we hold and object to certain processing. Email us — there's no form. Full detail in the Privacy Policy.
If we add a tool or drop one, this page changes and the date below updates. For anything significant we'll say so rather than hoping you don't notice.
info@wildhollowco.com
Put "Privacy" in the subject line. Formal requests answered within one month, most within 1–2 business days.
Updated 23 Aug 2026