1. Scope
Cookies are small text records stored in the browser. Similar technologies such as local storage and session storage allow the application to keep certain information in the browser.
This policy explains cookies and similar technologies used across the website, application, dashboard, Strategy Lab, Asset Creation, Marketing Mix, support widget, integration pages and campaign/reporting experiences.
Essential cookies are required for the service to work. Non-essential technologies such as analytics, ad measurement, remarketing, heatmaps and similar tools are used only when the relevant technology is enabled and any preference/consent mechanism required by applicable law is applied.
2. Essential session and security cookies
- _sid: an httpOnly refresh-token cookie. It is essential for secure session renewal and keeping the user signed in without repeated login. The default retention period is 7 days.
- _ma, _oa, _ee, _mcl: httpOnly security decoy cookies. They contain fake values that resemble session tokens and are used to make token-targeted attacks harder. The default retention period is 7 days.
- connect.sid: a session cookie used by the Passport/Express session mechanism. It may be used for OAuth and session flows. The default retention period is 24 hours.
- Language and routing records: language is primarily managed through the URL prefix. Browser or framework-level technical records may be created for language handling.
3. In-product local storage records
authToken: the access token received after login is stored in browser localStorage and used for API authentication. It is removed on logout; when it expires, it may be renewed through the refresh-token flow.
mmx.strategyLabV2.closedApprovals: stores dismissed approval/action cards in Strategy Lab. It is used for user experience continuity and is not designed to store sensitive content.
editor-comments:{projectId}: stores project-specific comment pins in the Asset Creation editor. It keeps the editor experience continuous on the same device.
Some modules may read temporary session storage records for live connections or SSE streams. These records support core application behavior.
4. Analytics and performance technologies
When Google Analytics 4 is used, cookies such as _ga and _ga_<container-id> may be used for visitor/session distinction, page views, event measurement, funnel analysis and product usage analytics. Google states a typical 2-year duration for the _ga cookie; property settings may change retention.
When Yandex Metrica is used, cookies such as _ym_uid, _ym_d, _ym_isad, _ym_visorc and similar records may be used for visits, sessions, traffic source, behavior analysis and performance measurement.
When Hotjar or similar user-experience analytics tools are used, cookies such as _hjSessionUser_*, _hjSession_*, _hjIncludedInSessionSample_*, _hjAbsoluteSessionInProgress and similar records may be used for heatmaps, session sampling, click/scroll behavior and usability analysis.
This category is used to understand product and site performance rather than directly targeting individual users for sales. It is non-essential and may be disabled through preference/consent settings.
5. Ad measurement and marketing cookies
When Google Ads and Google Marketing Platform are used, cookies such as _gcl_*, _gcl_au, _gac_*, IDE, test_cookie and similar records may be used for ad click attribution, conversion measurement, campaign performance, frequency capping and ad effectiveness measurement. Google states a typical 90-day duration for _gcl_ cookies.
When Meta Pixel and Meta Conversions API supported measurement are used, identifiers such as _fbp, _fbc and similar records may be used for ad click attribution, conversion matching, campaign measurement and remarketing audiences. Conversions API may also process server-side event data in addition to browser cookies.
When TikTok Pixel/Events API is used, identifiers such as _ttp, ttclid and similar records may be used for TikTok ad click attribution, conversion measurement, event matching and campaign optimization.
When LinkedIn Insight Tag is used, cookies such as li_fat_id, bcookie, bscookie, lidc, UserMatchHistory and similar records may be used for LinkedIn ad measurement, conversion tracking and professional audience performance analysis.
This category is non-essential. Remarketing, targeting or campaign-measurement technologies should not be enabled without any preference/consent required by applicable law.
6. Google Search Console, Business Profile and integration tools
Google Search Console, Google Business Profile, Google Merchant Center or similar account connections usually do not place a new marketing cookie directly on site visitors; they are mainly used for ownership verification, performance reporting, search visibility, business profile management or account integration.
When you connect integrations such as Google, Meta, LinkedIn, TikTok, Canva, HubSpot, Salesforce or similar providers, those providers may use their own cookies on their own websites, OAuth screens or services. Those cookies are not placed by us under the My Marketing Mix domain.
7. Preference and consent management
When a cookie preference panel is enabled, you can turn non-essential analytics, advertising, marketing and experience cookies on or off by category. Preferences may vary by device, browser and domain.
Essential cookies cannot be disabled because they are required for secure service operation. Rejecting analytics and marketing cookies does not block core application use, but measurement, personalization, campaign optimization and certain reporting features may be limited.
Global Privacy Control, browser permissions, advertising ID settings and providers' own ad preference centers are considered where applicable.
8. Browser controls
You can delete, block or allow cookies and site data for specific sites through browser settings. Browsers such as Chrome, Firefox, Safari, Edge and Opera provide site-level cookie controls.
You can clear local storage records from your browser's site data settings. This may log you out, reset dismissed Strategy Lab approvals or remove Asset Creation editor comments stored on that device.
Blocking essential session and security cookies may break login, token renewal, OAuth and core application features.
9. Changes and contact
The cookie inventory may be updated as new integrations, marketing tools, measurement systems or product features are enabled. For questions, contact us at [email protected].