Cookies and Browser Storage

Maestra Platform uses cookies to recognize a visitor’s device from one visit to the next. That way, page views, cart activity, and form submissions are tied to the right customer profile and can power personalization.

Summary

Maestra Platform cookies hold an anonymous device identifier or technical markers. They contain no names, email addresses, phone numbers, or other contact details.
Records about pop-up views, closes, and submissions live in the browser’s local storage, not in cookies — so they aren’t sent to the server with every request.

Main cookies

Cookie	Set on	Lifetime	Purpose
`maestraDeviceUUID`	Your website (top-level domain, first-party)	Up to 400 days (the browser limit), renewed on each visit	Anonymous device identifier (DeviceUUID). Links on-site activity on this device to the customer profile in Maestra Platform.
`deviceUUID`	Maestra tracking API domain (e.g., `api.maestra.io`), third-party	Up to 400 days, renewed on each visit	Server-side copy of the device identifier. `HttpOnly` and `Secure`. Browsers that block third-party cookies (Safari, Firefox) don’t keep it — tracking keeps working through the first-party cookie.
`popmechanic_sbjs_migrations`	Your website (first-party)	6 months, renewed when the pop-up script loads	Technical marker the pop-up and forms script uses for traffic-source tracking. Set when the site has at least one Maestra Platform pop-up or form. Contains no personal data.
`_qz_sess`	Your website (first-party)	24 hours, renewed on each display	Session ID for a product-finder quiz. Only set when such a quiz is shown.
`maestraConsent`	Your website (first-party)	Up to 1 year after the choice; about 7 days in Safari and other browsers with tracking prevention	The visitor’s cookie-banner choice. Only set when the tracker is configured for consent and the visitor answers. Contains no identifiers. See Consent cookie.

Legacy cookies

Cookie	Set on	Lifetime	Purpose
`mindboxDeviceUUID`	Your website (first-party)	Up to 400 days, renewed on each visit	The same device identifier under its legacy name. Only present on sites that use the older tracker setup; otherwise it isn’t set.
`directCrm-session`	Your website (first-party)	Up to 400 days (set for 2 years; browsers cap it at 400 days)	Legacy copy of the device identifier, kept for compatibility with older integrations.

The tracker requests a longer expiry for the identifier cookies, but modern browsers (Chrome and others) cap any cookie at 400 days. In practice, the cookie lives up to about 13 months after the visitor’s last visit.

When the tracker is set up for consent (see Consent and Tracking), it remembers the visitor’s last choice in the maestraConsent cookie. On later pages, it applies the choice right away instead of waiting for the banner, and it doesn’t send the same choice twice. The cookie holds a JSON object:

{
  "state": "granted",
  "timestamp": "2026-11-03T10:15:00.000Z",
  "v": 2,
  "purposes": {
    "analytics": "granted",
    "marketing": "granted",
    "preferences": "denied",
    "advertising": "denied"
  },
  "saleOfData": "granted",
  "source": "platform",
  "provider": "shopify",
  "reported": true
}

Field	What it holds
`state`	The visitor’s choice: `granted` or `denied`. Absent when only a Global Privacy Control opt-out was recorded.
`timestamp`	When the choice was made.
`v`	The cookie format version, `2`. Earlier tracker versions wrote only `state` and `timestamp`.
`purposes`	The choice per purpose, if the consent tool passed purposes.
`saleOfData`	`granted` or `denied`, if known.
`source`	Where the choice came from: `platform` (a consent banner or consent tool), `api` (a `consent.set` call), `gpc` (Global Privacy Control), or `stored`.
`provider`	The consent tool’s name, if it was passed.
`reported`	`true` once the choice was sent to Maestra Platform. Present only when storing consent on the profile is turned on for your account.

The cookie expires one year after the choice was made. Saving the same choice again doesn’t extend it. Safari and other browsers with tracking prevention delete cookies set by scripts after about 7 days, so a returning visitor may see the banner again.

Temporary technical cookies

The tracker also sets two cookies that are deleted immediately — in under a second:

Cookie	Purpose
`domaintest`	Checks which top-level domain cookies can be set on.
`testcookie`	Checks that cookies are enabled in older browsers.

Other data stored in the browser (not cookies)

To decide when and to whom to show pop-ups, Maestra Platform also keeps some data in the browser’s local storage, session storage, and IndexedDB. This data stays on the device and isn’t sent with every request.

Storage	What it holds	Lifetime
localStorage: `maestraDeviceUUID` / `mindboxDeviceUUID`	Backup copy of the device identifier	Until cleared
localStorage: `maestra_cart`	Cart contents for the Shopify integration	Until cleared
localStorage: keys starting with `popmechanic.`	Pop-up display rules: when a pop-up was last shown, closed, or submitted; A/B test variant; recently viewed pages; segment check cache	Until cleared
localStorage: keys starting with `popmechanic_sbjs_`	Traffic source of the first and current visit (source, channel, UTM campaign, referrer, number of visits)	6 months; session data 30 minutes
sessionStorage: `maestraLanding`	The landing page saved while the visitor hasn’t answered the cookie banner (buffer mode, see Consent and Tracking)	Until the visitor answers, or the tab is closed
sessionStorage: `popmechanic.session-start`, `popmechanic.la`	Session start and last activity time (for “time on site” and “inactivity” rules)	Until the tab is closed
IndexedDB: `popmechanic.db`	History of pop-up events and viewed pages, used for targeting (e.g., “viewed product X”)	6 months; older records are removed daily

If your site uses a consent tool, list the cookies above under the category that matches your privacy policy. Maestra Platform cookies are used for customer recognition, analytics, and on-site personalization. Classifying them is your call as the site owner — check with your legal team.

How to check on your own site

Open your website and use your browser’s developer tools to see these records for your domain.

Chrome
Safari

Go to DevTools → Application → Cookies (and Local Storage / IndexedDB).

Questions? Contact your Maestra Platform Forward Deployed Marketer.

Customers, orders and products

Import data

Filters

Segments

Flows

Campaigns

Personalization

Mobile app personalization

Ad Optimization

Loyalty

Reports

API integrations

Administration

Security

Summary

Main cookies

Temporary technical cookies

Other data stored in the browser (not cookies)

How to check on your own site

​Summary

​Main cookies

​Consent cookie

​Temporary technical cookies

​Other data stored in the browser (not cookies)

​For your cookie banner

​How to check on your own site

Summary

Main cookies

Consent cookie

Temporary technical cookies

Other data stored in the browser (not cookies)

For your cookie banner

How to check on your own site