Overview

Poltio Widgets sets two cookies and one localStorage entry. The Poltio SDK, if you include it, sets one cookie and a small number of localStorage entries. Nothing else is written to the browser — no IndexedDB, no Cache Storage.

Browser storage entries are listed here alongside the cookies because ePrivacy treats reading from and writing to a visitor's device the same way regardless of the mechanism used.

Cookies

poltio_widget

Poltio Widget uses this cookie to carry the visitor's session — the access token issued for the widget, and the publisher-supplied visitor id (puid) when your integration passes one. It is a functional cookie, so we don't have to get new tokens on every session. It is optional: if we can't leave cookies due to iOS restrictions or client preferences, the widget uses single session tokens instead of this cookie.

The cookie's expiry is pinned to the expiry of the access token it carries, so the two always die together. Tokens are issued with a 6 month lifetime, so this cookie lives at most 6 months. A visitor who interacts with the widget again is issued a new token, and the cookie's expiry moves with it — the 6 months run from the visitor's last interaction, not from their first.

Set with HttpOnly, Secure and SameSite=None.

poltio_widget_temp

Poltio Widget uses this cookie to remember that a visitor declined the cookie disclaimer, so the disclaimer is not shown again. It lives 7 days. Set with HttpOnly, Secure and SameSite=None.

poltio_sdk_voter

Poltio SDK uses this cookie to measure the impact of recommended products in your website and only in your website. This cookie lives 60 days.

Its value is an encrypted UUID — no personal data is stored in the cookie itself. It is set with HttpOnly, Secure, SameSite=None and Partitioned (CHIPS), so the browser keeps a separate copy per top-level site and the identifier cannot be used to follow a visitor across other websites.

Browser Storage

These entries are written in the visitor's browser and are never sent to Poltio servers. Each is scoped to the origin that wrote it: SDK entries to your own site, widget entries to the widget's own origin.

When the widget is loaded with cookie=off, it writes to sessionStorage instead of localStorage, so everything below is discarded when the visitor closes the tab.

widget_disclaimer

Written by Poltio Widget. Records that a visitor dismissed the cookie disclaimer, so it is not shown again. This entry has no expiry and persists until the visitor clears their site data.

poltio_ab_<widgetId>

Written by Poltio SDK. Remembers which variant of an A/B test a visitor was assigned, so the visitor keeps seeing the same variant. Stores the chosen widget id, or off when the visitor was assigned to no widget. This entry has no expiry and persists until the visitor clears their site data.

poltio-content-<contentId>-closed

Written by Poltio SDK. Remembers that a visitor dismissed a pill or box widget, so it is not shown again right away. It lives 48 hours by default; the duration is configurable per integration with the pillCloseRememberDuration and boxCloseRememberDuration parameters.

flying_closed

Written by Poltio SDK. Remembers that a visitor closed a flying widget, so it does not reopen on scroll. It lives 48 hours.

poltio_preload_reloaded

Written by Poltio Widget to sessionStorage only. A technical guard that records the timestamp of a page reload triggered by a failed asset load, so the widget does not reload in a loop. It holds no information about the visitor and is discarded when the tab is closed.