Cookies & Tracking
Last updated: August 20, 2026
One cookie and fifteen browser storage keys. This page names every one of them, says which are covered by the analytics opt-out, and sets out exactly what our first-party analytics record.
The short version
This site sets exactly one HTTP cookie, and it is only ever set for staff who log into the admin area. Everything else we keep on your device is localStorage or sessionStorage, written by the site itself and readable only by this site.
There are no third-party advertising or social media trackers here. Our analytics are first-party: the data goes to our own database, not to an ad network, and it is never sold or shared for advertising.
The register below lists every key by name. Nothing we store on your device is left off it.
When analytics start, and what stops them
Analytics collection begins as soon as a page loads, before you interact with the privacy notice. The notice is an opt-out rather than an opt-in, and we would rather say so here than imply otherwise.
Choosing "Opt out" writes the ar-analytics-optout key and stops everything analytics-related from that browser: no further events are sent, no further analytics keys are written, and the attribution details that would otherwise be stamped onto an order are dropped. It does not retroactively delete events already recorded, so if you want those removed as well, email us and we will do it by hand.
We also honour your browser’s Do Not Track and Global Privacy Control signals automatically. If either is switched on, nothing is collected and no analytics keys are written, whatever you do with the notice.
Keys written before you opted out stay in your browser until you clear site data. You can remove them yourself at any time in your browser settings.
Every cookie and storage key we use
"Essential" keys are needed for the store to work or to honour a choice you made. "Functional" keys remember a preference and are not covered by the analytics opt-out. "Analytics" keys are covered by the opt-out and by Do Not Track or Global Privacy Control.
| Key | Stored as | What it is for | Category |
|---|---|---|---|
| autorack-cart | localStorage | Your cart contents and any discount code you applied, so the basket survives a reload or a return visit. | Essential |
| ar-privacy-ack | localStorage | Records that you have seen the privacy notice, so it stops reappearing on every page. | Essential |
| ar-analytics-optout | localStorage | Records that you opted out of analytics. Deleting this key turns analytics back on. | Essential |
| ar-sid | sessionStorage | A random session identifier. It labels your analytics events, addresses your live chat thread so replies reach you and nobody else, and is stamped onto an order you place in the same visit. Cleared when the tab closes. | Essential and analytics |
| ar-wishlist | localStorage | The products you saved. The list itself stays in your browser, but each time you add an item we also send that product to our own analytics as a demand signal. | Functional |
| ar-recently-viewed | localStorage | The last products you looked at, used to build the "recently viewed" row. This one never leaves your browser. | Functional |
| ar-chat-email | localStorage | The email address you gave in live chat, so you are not asked for it again next time. | Functional |
| ar-promo-dismissed | localStorage | Records that you closed the discount popup, so it does not open again. | Functional |
| ar-promo-subscribed | localStorage | Records that you already signed up through the popup, so we stop showing it. | Functional |
| ar-announce-dismissed | sessionStorage | Records that you closed the announcement bar, for the rest of this tab session. | Functional |
| ar-visited | localStorage | A permanent marker that this browser has been here before, so a page view can be counted as "new" or "returning". It does not expire on its own and it survives across visits until you clear site data. | Analytics |
| ar-landing | sessionStorage | The first page you landed on this visit. Sent with every analytics event and stamped onto an order you place. | Analytics |
| ar-ref | sessionStorage | The hostname of the site that sent you here, captured once on first touch. | Analytics |
| ar-utm | sessionStorage | Campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content) from the link you arrived on, kept for the visit. | Analytics |
| ar-purchase-<order id> | sessionStorage | Marks one completed order as already counted, so reloading the confirmation page does not record the purchase twice. | Analytics |
| ar_admin | HTTP cookie | The only cookie this site sets: a signed staff login token for the admin area, httpOnly and secure, expiring after 8 hours. It is never set for customers. | Essential, staff only |
Blocking or clearing the essential keys is entirely your call, but it will break the cart, checkout and live chat, and it will reset your analytics opt-out.
What our analytics actually record
Each event is written to our own database with the following, and nothing beyond it:
- what happened: a page view, search, fitment lookup, add to cart, checkout step, completed purchase, wishlist save, or a discount popup being shown, dismissed or used
- the page path, including any query string on it, and the ar-sid session identifier
- approximate location: the country and city our hosting provider derives from your connection
- device type, browser and operating system, read from your browser’s user agent
- on page views only: screen and viewport size, language, time zone, device pixel ratio, and whether the device is touch capable
- how you arrived: the referring hostname, the landing page, and any campaign tags on the link
- for cart, checkout and purchase events: the order value, the number of items, and the product names, quantities and prices in the cart
- for searches and fitment lookups: the text you typed and how many results it returned
We never store your IP address. It is read momentarily to work out an approximate country and city, and to tell a local development request apart from a real one, then discarded. Abuse counters keep only an irreversible salted hash of it.
Because ar-sid also travels onto your order and keys your chat thread, the analytics from a visit in which you bought something or messaged us can be linked back to you. We treat those records as personal information rather than as anonymous statistics, and the Privacy Policy sets out what that means for your rights.
Your choices
- Opt out of analytics using the "Opt out" option in the privacy notice. Your choice lives in this browser, so clearing site data or switching browser or device brings the notice back.
- Switch on Do Not Track or Global Privacy Control in your browser. We honour either automatically, with nothing further needed from you.
- Clear or block site storage in your browser settings at any time. The site data controls in Chrome, Safari, Firefox and Edge remove every key in the register above.
- Ask us to delete the records held against your session identifier by emailing contact@theautorack.com. Include the ar-sid value if you still have it, or the order number, so we can find the right records.
Opting out never affects your ability to browse, order or get support.
Third-party storage
When you are handed off to Stripe to pay, Stripe sets its own storage on its own checkout page for payment processing and fraud prevention. That happens on Stripe’s domain under Stripe’s privacy policy, and we cannot read it.
No other third party sets or reads storage through this site. We do not embed advertising pixels, social sharing widgets, session recorders or heatmap tools.
Changes
If we add a cookie or storage key, it goes into the register above at the same time, and where the law requires consent we will ask for it first.
Questions
Email contact@theautorack.com with any question about tracking on theautorack.com.
Other policies
Questions about this policy? Email contact@theautorack.com.