Cookie Policy

1. What cookies are

Cookies are small text files a website saves in your browser. Other browser storage technologies work in a similar way, such as localStorage (kept until you clear it) and sessionStorage (gone when you close the tab). In this policy we simply call them all "cookies" unless we say otherwise.

Under Article 4(5) of Romanian Law 506/2004, a website may store or read information on your device only with your consent. The exception is information strictly necessary to carry the communication or to provide a service you have explicitly asked for.

This policy covers the mia.store website, the Mia app and creators' stores, including those on their own domains. For everything else about your personal data, read the Privacy Policy.

2. Cookie categories

Necessary. Without them, the site does not work or is not secure: logging in, the anti-bot check and saving your cookie choice. They are always on.
Functional. They remember a preference you chose, such as language or currency. We set them only when you click that option, so at your request. They do not appear as a separate option in the banner.
Analytics. They count visits to creators' stores and show which post led to a sale (the mia_attr cookie), so each creator can see their statistics. They include Google Analytics 4 if a creator has added it to their store. Only with your consent.
Marketing. They remember affiliate referrals and include ad pixels added by creators (Meta Pixel, TikTok Pixel, Pinterest Tag). Only with your consent.

On the mia.store website we use no Google Analytics and no ad pixels.

3. Cookies set by Mia

Name	What it does	Duration	Category	Set by
__Host-mia_session	Keeps your login session in your creator account	30 days	Necessary	Mia
__Host-mia_buyer_session	Keeps your login session in your purchases library	30 days	Necessary	Mia
mia_attr	Signed token showing which post or link last led to an order, so the sale is credited correctly. It holds no name or email	30 days	Analytics, only with your consent (details below)	Mia
mia_aff	Remembers an affiliate referral (links containing ?ref=)	Up to 90 days	Marketing, only with your consent	Mia
mia_mkt_currency	Remembers the currency you chose (RON or EUR) on the pricing page	180 days	Functional, set only when you click	Mia
mia_locale_hint	Remembers the language you chose, for the language suggestion	180 days	Functional, set only when you click	Mia
mia_lang_suggest_dismiss	Hides the language suggestion after you close it	180 days	Functional, set only when you click	Mia

4. What we save in browser storage

Key	Type	What it does	Category
mia.consent.v1	localStorage	Your cookie choice	Necessary
mia.attr.v1	localStorage	Copy of the attribution token, for in-app browsers that do not keep cookies	Analytics, only with your consent; deleted if you say no or withdraw consent
mia.aff.v1	localStorage	Copy of the affiliate token	Marketing; deleted if you say no
mia_sv_sid	sessionStorage	Identifier for the open tab, used to count store visits	Analytics, only with your consent; gone when you close the tab
mia.pixel.purchase.{orderId}	sessionStorage	Stops the same purchase being reported twice to the creator's pixel	Analytics or marketing, only with your consent
Cache Storage: workbox-precache-*, pages, static-assets	Cache Storage	Copies of our own files (scripts, styles, images) and of pages without parameters in the address, so the site loads fast and shows an offline page. Pages with parameters in the address (for example the attribution token), checkout pages and short-link pages are never saved. It holds no pixel and no ad data	Necessary
mia-dash-locale	localStorage	Dashboard language	Functional (dashboard only)
mia_push_sale_prompt_dismissed	localStorage	Remembers that you closed the prompt to turn on push notifications	Functional (dashboard only)

5. The mia_attr attribution cookie

When you reach a store through a Mia short link, we count the click and add a signed token to the store address. Counting the click sets no cookie. We save one record per click: the date, a hash of your IP address that changes every day (never the address itself), the site you came from (its address without any query or parameters), your country and the type of device. We also add 1 to the total for the link. We delete the individual click records after 90 days; the total for the link stays. The token shows which post or link brought you there and holds no name, email or other contact details. If you then buy, the sale is credited to that post, and the creator can see which posts bring them sales.

The mia_attr cookie belongs to the analytics category. If you agree to analytics, we keep the token for 30 days in the mia_attr cookie and in a copy in localStorage (mia.attr.v1), so the sale is credited even if you buy later. The localStorage copy helps in-app browsers that do not keep cookies.

Without your consent we save nothing on your device. The token stays only in the page address and in the memory of the open tab, so you can still buy and the sale is credited, but only during that visit. If you say no or withdraw your consent, we delete the cookie and the localStorage copy.

A mia_attr cookie saved in the past, without asking, is no longer read by us and goes away on your next click on a Mia short link or after 30 days at the latest. You can also delete it in your browser settings at any time. Deleting it does not stop you from buying.

6. Other companies' technologies

Cloudflare Turnstile. Checks that you are a person, not a bot, at login, sign-up, purchases library login, lead forms and checkout. It loads from challenges.cloudflare.com and is necessary for security.
Stripe. Payment happens on Stripe's hosted checkout page (checkout.stripe.com). There, Stripe sets its own cookies under Stripe's policy.
Bunny Stream. On course lesson pages, videos are played by the Bunny player, loaded from iframe.mediadelivery.net.
Pixels added by creators. A creator can add Google Analytics 4 (analytics category), Meta Pixel, TikTok Pixel or Pinterest Tag (marketing category) to their store. They load only after you agree. Their cookies (for example, _ga or _fbp) are set by those providers, and their durations follow those providers' policies. For these pixels, the creator is the controller and is responsible for using them.
Sentry. We use Sentry for error reporting. With our settings it sets no cookies, and personal data is removed from reports.

Fonts are hosted on our own servers, so your browser makes no requests to Google Fonts.

7. Tracking in emails

Campaigns that creators send through Mia contain a pixel that shows whether the email was opened and links that show what was clicked. Mia does the measuring for the creator, who is the controller of this data. Service emails, such as receipts and login links, contain no such tracking.

If you don't want opens to be recorded, you can turn off automatic image loading in your email app.

8. How we ask for your consent

The cookie banner shows you the categories: necessary (always on), analytics and marketing.
You can say no as easily as you say yes.
Nothing optional loads before you choose.
For Google tools a creator may add, we set the Google Consent Mode v2 signals to "denied" from the start, before any choice.
Your choice is saved only in your browser (localStorage, key mia.consent.v1). For now it does not expire automatically: it stays until you clear or change it.

9. How to change or withdraw your consent

You can reopen the banner and change your choice at any time. The same button is in the footer of mia.store and of every creator page.

Withdrawing consent is as easy as giving it and applies from then on. We delete the analytics or marketing cookies and copies in localStorage and sessionStorage, including the cookies of ad pixels, and reload the page if a pixel had already loaded on it.

You can delete cookies and site data at any time in your browser settings. After that, the banner appears again on your next visit. Browsers usually also let you block cookies; if you block the necessary ones, logging in will not work.

10. Stores on their own domains

Some creators run their store on their own domain. The same banner and the same rules apply there, and cookies are set on the creator's domain.

Your browser keeps your choice separately for each domain, so we may ask for your consent again on a creator's domain even if you have already chosen on mia.store.

The creator is responsible for the pixels they add and for their store's privacy notice.

11. Changes to this policy

When we update this policy, we change the date at the top of the page. If we add a new optional technology, we do not use it without your consent.

12. Contact

For questions about cookies and your data, write to us at privacy@mia.store. You will find more in the Privacy Policy.