Cookie Policy
WaL Store uses necessary cookies and browser storage to run checkout, accounts, cart, security, and cookie preferences. Marketing, analytics, preferences, and optional third-party scripts stay disabled unless you allow them in Cookie Preferences.
You can change your choices at any time from the Cookie Preferences link in the footer. Rejecting non-essential cookies does not block checkout, cart, account sessions, or payment.
| Name | Type | Lifetime | Purpose | Category |
|---|---|---|---|---|
| wal_cookie_consent | Local storage | Until cleared or consent version changes | Stores cookie choices, version, and timestamp. | Necessary |
| store_session | HTTP-only cookie | 7 days | Keeps customer account sessions active. | Necessary |
| admin_session | HTTP-only cookie | 8 hours | Keeps admin sessions active. | Necessary |
| webauthn_challenge / admin_webauthn_challenge | HTTP-only cookie | 5 minutes | Temporary passkey login or registration challenge. | Necessary |
| cart-storage | Local storage | Until cleared | Keeps shopping cart items available between page visits. | Necessary |
| display-currency-storage / wal_display_currency | Local storage | Until changed or cleared | Remembers the selected display currency. | Preferences |
| checkout_form_state | Session storage | Up to 30 minutes | Restores checkout form fields after reloads. Card numbers are not stored. | Necessary |
| wal_post_checkout_order_id | Session storage | 15 minutes | Helps return customers to the recent checkout success page. | Necessary |
| _fbp / _fbc | Meta cookie | Provider controlled; _fbc is 90 days when created by this app | Meta Pixel and Conversions API attribution. | Marketing |
| Trustpilot review collector | Third-party script | Provider controlled | Optional review collection script. | Marketing |
Meta tracking
If marketing consent is enabled, Meta Pixel may load and Meta Conversions API events may be sent. These events can include page or checkout event names, event IDs, product IDs, order value, URL, IP address, user agent, Meta identifiers, and hashed email or phone when available. If marketing consent is rejected, these scripts and events are skipped.
