Draft — pending legal review. These documents are provided for transparency and are not yet in force. They must be reviewed by a qualified solicitor before Yonto takes any payment. Do not rely on them until then.

Cookie Notice

Last updated: 22 October 2026 · v2026-10-22

Every cookie and stored item Yonto uses, what it holds, and how long it lasts — on our app, on your store, and on the billing page. None is used for advertising.

Yonto is operated by Mohamed Shill, trading as Yonto Sales — see the Terms for full operator details.

1. The whole list, in one table

This is everything Yonto itself sets. The only other cookies are our payment provider's, on the billing page — see section 4. Nothing here is shared with an advertising network, and nothing follows a shopper to another website.

Cookie	What it does	Type	Lifetime
Sign-in session	Keeps you signed in to the Yonto app. Named sb-…-auth-token; may be split across several cookies when large.	First-party, strictly necessary — yontosales.com	Up to 400 days, cleared on sign-out
Sign-in link check	Set when you ask for a sign-in link, and checked when you open it, so the link only works in the browser that requested it. Named sb-…-auth-token-code-verifier.	First-party, strictly necessary — yontosales.com	Removed when you sign in in that browser; otherwise up to 400 days
Active business	Remembers which of your businesses the dashboard is showing, when your account has more than one. Holds an identifier for the business, and nothing about a shopper. Named proof_active_business.	First-party, strictly necessary — yontosales.com	1 year
Chart period	Remembers the period you last chose for the dashboard's charts (7, 30 or 90 days, or All), so the next page opens on it. Set only when you choose one. Holds that choice and nothing else. Named yonto_period.	First-party, functional, set at your request — yontosales.com	1 year
Click identifier (pixel)	On stores that run our pixel only: holds the random id from a creator's tracked link, so a later purchase can be credited to that creator. Named proof_ref.	First-party, set on YOUR site by our pixel	30 days
Click identifier (Shopify custom pixel)	On Shopify stores using our custom pixel only, and only once the shopper has allowed analytics: the same random id, kept in the store's browser storage rather than a cookie. Named yonto_ref.	Browser storage on YOUR Shopify store	Until the shopper clears site data

2. Cookies on the Yonto app

When you sign in to Yonto we use strictly necessary first-party cookies to keep you logged in and to keep the app secure. These are required for the app to work and cannot be switched off without breaking sign-in. They are set on yontosales.com, not on your store.

3. Attribution on your store

The tracked link sets no cookie. It records the click and sends the shopper to your store with a random click identifier in the address. Whether anything is then stored on the shopper's device depends on how your store is connected:

Our pixel (WooCommerce, Wix, Squarespace, BigCommerce, Webflow and custom sites) keeps the identifier in one first-party cookie on your site for 30 days, so a purchase a few days later can be credited to the right creator.
Our Shopify custom pixel keeps it in your store's browser storage, and only after the shopper has allowed analytics.
Discount codes, Shopify's order notification and our server API store nothing on the shopper's device at all.

The identifier is an opaque string that is not derived from the person and means nothing on its own. It holds no name, no email, no browsing history and no profile, and it is not read on any other website. See the Privacy Policy for what the click record itself contains.

4. The billing page

When you open Billing to subscribe or change plan, the page loads the checkout of our payment provider, Paddle, which acts as merchant of record. Paddle may set its own cookies there, for example to run the checkout securely and prevent fraud. Those are Paddle's, described in Paddle's own cookie policy, and we do not read them. This happens only on the billing page, only when you are signed in, and never on your store.

5. What we do not use

No third-party advertising or retargeting cookies.
No cross-site trackers, and no data sold or shared with ad networks.
No device or browser fingerprinting.
No analytics cookies on your store — the pixel measures referred visitors only.

On sites running our optional pixel, the script does nothing at all for a visitor who did not arrive through a creator's tracked link. With no Yonto referral present it returns immediately and sends no data.

The pixel's cookie and the Shopify custom pixel's stored identifier are set on your website, which makes the consent obligation yours. Depending on where your shoppers are, you may need to obtain cookie consent before it is set, and you are responsible for your store's cookie banner and consent records.

Our view is that the click cookie is strictly necessary to a service the shopper has actively engaged with — they followed a creator's link — but that is a judgement for you and your own advisers, not a determination we can make on your behalf.

7. What happens if a shopper refuses

Nothing breaks. Where a shopper rejects tracking, the identifier is simply not stored and the visit is not linked to a creator. A later purchase is still credited if the order reaches us another way: on a connected Shopify store, by the creator's discount code, which arrives with Shopify's own order notification; or from a store that reports its orders from its own server. On a store that relies on our pixel alone, it is not counted — the discount code included. This is one of the reasons Yonto describes its figures as a confident floor rather than a complete count — refused cookies are invisible to us by design, and we would rather undercount than guess.

8. Do Not Track and Global Privacy Control

There is still no agreed standard for how sites should respond to Do Not Track (DNT), so we do not claim to honour it. We do not use cookies for advertising, sale or sharing of personal information, so a Global Privacy Control (GPC) signal has nothing to opt out of here — there is no such processing to stop.

9. Managing cookies

You can clear or block cookies in your browser settings at any time. Clearing the attribution cookie means a later purchase may not be credited to the creator who referred the shopper. Clearing the app's session cookie signs you out.

10. Changes to this notice

If we add, remove or change a cookie, the table in section 1 changes with it and the "last updated" date at the top of this page moves. We will not add an advertising or cross-site tracking cookie to this product.

11. Contact

Questions about cookies: privacy@yontosales.com.