Cookies
Open Commerce Online uses essential cookies only on this pass. There is no marketing or advertising pixel, and no consent banner, because we do not set non-essential analytics cookies in the product as shipped.
Cookies we set
| Name | Purpose | Duration (typical) |
|---|---|---|
| Supabase Auth session | Keep an operator or shopper signed in | Session / refresh window set by Auth |
cc_cart_session | Guest cart identity | 180 days |
order_token_{orderId} | Guest order receipt access after checkout | HttpOnly, SameSite=Lax |
pos_device | Bound POS device | HttpOnly |
pos_kiosk | Kiosk lock on a paired device | Until PIN exit |
All of these are first-party, HttpOnly where they hold a secret, SameSite=Lax, and Secure on HTTPS. They are required for login, cart, guest order lookup, or in-person POS. Blocking them will break those flows.
Third parties
Stripe, WalletConnect/Reown, and similar providers may set cookies inside their own frames or domains when you pay. Those are governed by those providers’ notices, not this table.
Changes
If we later enable Vercel Web Analytics, Speed Insights, or similar non-essential measurement, this page and a consent mechanism will be updated before those cookies are set.