What cookies are
A cookie is a small piece of text a website asks your browser to store, so it can recognise you on the next page-load. Some are essential (signing in wouldn't work without them); others are used to track behaviour across sites. Zillo only uses the first kind.
Cookies Zillo sets
| Name | Purpose | Lifetime | Where it's set |
|---|---|---|---|
sb-*-auth-token | Keeps you signed in to your dashboard account. Issued by our authentication provider (Supabase). | Up to 1 year (refreshes on use) | dashboard.zillo.app |
active_merchant_id | Remembers which Zillo store you last opened, so the dashboard lands on the right one when you sign back in. | 30 days | dashboard.zillo.app |
zillo_ref_token | Remembers which Zillo merchant referred you, so you can be credited if you sign up. Only set when you arrive with a?ref= link. | 30 days | zillo.app (apex) |
customer_session_* | When a customer signs into a merchant's storefront (e.g. to view their order history), this cookie keeps them signed in. Set per-merchant; never shared across stores. | 30 days | The merchant's storefront domain |
Third-party trackers on zillo.app
We do not load Google Analytics, Meta Pixel, Hotjar, Segment, PostHog, or any equivalent product on the Zillo marketing site (zillo.app), the dashboard (dashboard.zillo.app), the API (api.zillo.app), or the help center (docs.zillo.app).
Third-party trackers on merchant storefronts
Merchants on a Zillo Pro plan may add their own conversion pixels — typically Meta (Facebook) Pixel, Google Analytics 4, or TikTok Pixel — to their storefront so they can measure their own ad campaigns. When this happens:
- The storefront shows a cookie preferences banner the first time you visit. You can accept, reject, or choose categories.
- No marketing cookies are set, and no third-party requests are made, until you accept the “Marketing” category.
- Your choice is stored per-store — accepting on one merchant's store doesn't carry over to another.
- To change your choice later, clear the cookies and storage for that storefront in your browser settings.
See the merchant's own privacy policy (linked from their storefront footer) for the exact list of pixels they have enabled and their lawful basis for processing.
Stripe
Checkout pages embed Stripe's payment forms. Stripe sets its own cookies (e.g. for fraud detection) which are governed by Stripe's own cookie policy. We don't set or read these cookies; they're strictly between Stripe and your browser.
How to opt out
You can clear or block Zillo's cookies in your browser settings. Blocking the sb-*-auth-token cookie will stop you being able to sign in. Blocking the others will work, but you may have to re-select your store each time you visit.
Changes
We'll update this page if we change what cookies we set. The “last updated” date at the top is the source of truth.
Questions
Anything unclear? Email privacy@zillo.app.