Cookie Policy
Last updated: October 19, 20261. What this policy covers
This Cookie Policy explains how Pcnaid Inc. (“Pcnaid”) uses cookies and similar tracking technologies when you use Pcnaid Loyalty & Rewards as an embedded Shopify app. The app does not set cookies on its own. Cookies referenced here are set by the Shopify platform, the Shopify admin, and the operational services the app depends on.2. How the app uses cookies
Pcnaid Loyalty & Rewards runs inside a Shopify Admin iframe and does not directly set cookies. The embedded app authenticates with Shopify App Bridge session (ID) tokens rather than third-party cookies. Any Shopify Admin cookies encountered while using the embedded app are first-party cookies managed by Shopify and are subject to Shopify’s own cookie policy. The embedded app also uses the browser’ssessionStorage (not cookies) to remember your shop domain and the last app page you opened, so it can return you to that page if the Shopify Admin session needs to be re-established. This stays in your browser, is cleared when the browser session ends, and is not used for analytics.
3. Third-party services
The following third-party services used by the app may set cookies or use similar storage:- Sentry may set a session cookie for error-reporting correlation.
- Datadog Browser RUM may set first-party cookies or local storage for session correlation.
- PostHog may set product-analytics cookies when enabled for product usage measurement.
- Mixpanel receives server-side product-analytics events and sets no browser cookie.
- Cloudflare Turnstile may set a visitor-session cookie for bot detection on protected public actions.
- Shopify CDN (cdn.shopify.com) serves static resources and may set its own performance and delivery cookies.
4. Storefront loyalty widget
The storefront loyalty widget and popups are rendered by the merchant’s Shopify theme. Cookie behavior on the merchant’s storefront is governed by the merchant’s own cookie policy and consent mechanisms. The Pcnaid storefront widget uses the browser’ssessionStorage (not cookies) to hold state for the current browser session only, including referral-validation state, popup-display state, and redemption idempotency keys.