On this page
Cookies and browser storage
Every cookie and storage key Candler uses, in three places: this site, the Candler dashboard, and the tracker on your store. Store owners can use the last part for their own cookie notice and privacy policy.
This site uses Candler's own tracker.
candleranalytics.com runs the Candler tracker, so it sets the cookies and local storage listed under what the tracker stores, on candleranalytics.com only. Browsers that send the Global Privacy Control signal get none of them, and this opt-out link turns tracking off and leaves only candler_optout and candler_consent to remember that. There are no ad pixels or other analytics, and the fonts come from our own server. Cloudflare, which carries traffic to our servers, can set a strictly necessary cookie such as __cf_bm when it checks whether a visitor is a bot.
The dashboard sets one cookie and remembers two choices.
| Name | Kind | How long | What it's for |
|---|---|---|---|
candler_session | Cookie, strictly necessary | 12 idle hours, 14 days at most | Keeps you signed in. It can't be read by scripts and is never sent to other sites. |
candler.prefs | Local storage | Until you clear it | Your display choices, such as light or dark theme. |
aa_dash_site | Local storage | Until you clear it | Which of your websites you last looked at. |
Checkout and Manage billing open on Stripe, which sets its own cookies under Stripe's cookie policy.
What the tracker stores on your store.
These are first-party: they belong to your store's domain, and no other site can read them. The same values are kept in local storage too, so a visitor isn't lost when a cookie is cleared or capped by the browser.
| Name | Kind | How long | What it's for |
|---|---|---|---|
candler_vid | Cookie and local storage | 400 days | A random visitor ID, so return visits are linked. |
candler_sid | Cookie and local storage | 30 minutes after the last activity (the store can set 5 to 240) | A random ID for the current visit. |
candler_sm | Cookie and local storage | Same as candler_sid | When the visit was last active, whether it's being recorded, whether a person has shown up yet, and its campaign. |
candler_consent | Cookie and local storage | 1 year | The visitor's yes or no. Set only when the store asks for consent or the visitor uses the opt-out link. |
candler_optout | Cookie and local storage | 400 days, renewed on each visit | Set only when the visitor uses the opt-out link. Keeps Candler off in that browser, even if a cookie banner later allows analytics. |
candler_exclude | Cookie and local storage | 400 days, renewed on each visit | Set only in browsers the store's own team leaves out with its exclude link, so their visits aren't recorded. |
candler_ctx | Local storage | Until the visit ends | The landing page and referring site of the current visit. |
candler_pending | Local storage | Until sent or the next page load, usually seconds | Events waiting to be sent, so a page change doesn't lose them. Nothing is sent until the visitor taps, clicks, types, scrolls with a wheel or moves the mouse. A visit that never does any of that is never sent, and what it left here is discarded on a later page load. |
candler_cfg: plus site ID | Local storage | Refreshed every 5 minutes | The store's tracking settings, so the tracker starts fast. |
candler_debug | Local storage | Until turned off | Only there if someone turns on debug logging. |
In the EU, the UK and anywhere with similar rules, these count as analytics cookies, not strictly necessary ones, so they need the visitor's consent before they're set.
Consent and opting out.
- Consent mode. Add
data-consent="required"to the script tag, or set Consent mode in Settings, Privacy. The tracker then sets nothing and sends nothing until your consent banner callscandler.consent(true). Callingcandler.consent(false)stops tracking and deletes the IDs. - Global Privacy Control. Browsers that send it aren't tracked. This is on by default.
- Opt-out link. Any page of your store with
?candler_optout=1added turns Candler off in that browser, for examplehttps://yourstore.com/?candler_optout=1. Put it in your privacy policy. It holds even when your cookie banner, or Shopify's privacy settings, allow analytics. Adding?candler_optout=0removes the choice.
Wording for your store's privacy policy.
Adapt this to your store and your settings. Fill in the parts in brackets, and check it against the rest of your policy. It isn't legal advice.
We use Candler Analytics to understand how people use our store and to fix problems. When you visit, Candler records the pages you view, your clicks, scrolling and mouse movement, and a replay of how the pages looked and changed during your visit. It also records your device and browser type, the site or campaign that sent you, and what you added to your cart or bought. Anything you type into a form is hidden before it leaves your browser, and payment fields aren't recorded. Candler stores a random ID in a cookie (candler_vid, up to 400 days) to recognize return visits, and doesn't store your IP address with your visits.
Candler processes this data for us under a data processing agreement, stores it in Germany, and doesn't sell it or use it for advertising. We keep recordings for [number] days. To turn Candler off in this browser, visit [https://yourstore.com/?candler_optout=1]. We also honor Global Privacy Control.