On this page
Cookies and browser storage
Every cookie and storage key Candler uses, in three places: this site, the Candler dashboard, and the tracker on your store. Store owners can use the last part for their own cookie notice and privacy policy.
This site sets no cookies.
candleranalytics.com has no cookies, no analytics and no ad pixels, and its fonts come from our own server. Cloudflare, which carries traffic to our servers, can set a strictly necessary cookie such as __cf_bm when it checks whether a visitor is a bot.
The dashboard sets one cookie and remembers two choices.
| Name | Kind | How long | What it's for |
|---|---|---|---|
candler_session | Cookie, strictly necessary | 12 idle hours, 14 days at most | Keeps you signed in. It can't be read by scripts and is never sent to other sites. |
candler.prefs | Local storage | Until you clear it | Your display choices, such as light or dark theme. |
aa_dash_site | Local storage | Until you clear it | Which of your websites you last looked at. |
Checkout and Manage billing open on Stripe, which sets its own cookies under Stripe's cookie policy.
What the tracker stores on your store.
These are first-party: they belong to your store's domain, and no other site can read them. The same values are kept in local storage too, so a visitor isn't lost when a cookie is cleared or capped by the browser.
| Name | Kind | How long | What it's for |
|---|---|---|---|
candler_vid | Cookie and local storage | 400 days | A random visitor ID, so return visits are linked. |
candler_sid | Cookie and local storage | 30 minutes after the last activity (the store can set 5 to 240) | A random ID for the current visit. |
candler_sm | Cookie and local storage | Same as candler_sid | When the visit was last active, whether it's being recorded, and its campaign. |
candler_consent | Cookie and local storage | 1 year | The visitor's yes or no. Set only when the store asks for consent or the visitor uses the opt-out link. |
candler_ctx | Local storage | Until the visit ends | The landing page and referring site of the current visit. |
candler_pending | Local storage | Until sent, usually seconds | Events waiting to be sent, so a page change doesn't lose them. |
candler_cfg: plus site ID | Local storage | Refreshed every 5 minutes | The store's tracking settings, so the tracker starts fast. |
candler_debug | Local storage | Until turned off | Only there if someone turns on debug logging. |
In the EU, the UK and anywhere with similar rules, these count as analytics cookies, not strictly necessary ones, so they need the visitor's consent before they're set.
Consent and opting out.
- Consent mode. Add
data-consent="required"to the script tag, or set Consent mode in Settings, Privacy. The tracker then sets nothing and sends nothing until your consent banner callscandler.consent(true). Callingcandler.consent(false)stops tracking and deletes the IDs. - Global Privacy Control. Browsers that send it aren't tracked. This is on by default.
- Opt-out link. Any page of your store with
?candler_optout=1added turns Candler off in that browser, for examplehttps://yourstore.com/?candler_optout=1. Put it in your privacy policy. Adding?candler_optout=0removes the choice.
Wording for your store's privacy policy.
Adapt this to your store and your settings. Fill in the parts in brackets, and check it against the rest of your policy. It isn't legal advice.
We use Candler Analytics to understand how people use our store and to fix problems. When you visit, Candler records the pages you view, your clicks, scrolling and mouse movement, and a replay of how the pages looked and changed during your visit. It also records your device and browser type, the site or campaign that sent you, and what you added to your cart or bought. Anything you type into a form is hidden before it leaves your browser, and payment fields aren't recorded. Candler stores a random ID in a cookie (candler_vid, up to 400 days) to recognize return visits, and doesn't store your IP address with your visits.
Candler processes this data for us under a data processing agreement, stores it in Germany, and doesn't sell it or use it for advertising. We keep recordings for [number] days. To turn Candler off in this browser, visit [https://yourstore.com/?candler_optout=1]. We also honor Global Privacy Control.