Legal
Cookie Policy
Version 2026-09-19 · Effective 19 September 2026
What cookies are
Cookies and similar storage are small pieces of data kept on your device or in your browser. Some are needed for the site to work; others are optional.
Your choice comes first
Merofly runs on essential storage only until you choose. Nothing in the Analytics or Advertising and marketing categories is loaded or written before you affirmatively allow that category — no Google Analytics, no Google Ads, no Meta, no TikTok, no other optional measurement or advertising identifier. Reject optional and Accept optional are offered with equal prominence, and both optional categories start switched off. Your account, checkout, support and invitation code all work if you reject optional cookies. Merofly.com keeps its own consent record and never reads or writes a consent record belonging to another Merofly site.
Cookie inventory
| Name | Vendor | Party | Purpose | Category | Duration | Status |
|---|---|---|---|---|---|---|
| sb-*-auth-token | Merofly (authentication service) | First party | Keeps you signed in and secures your account session. | Strictly necessary | Session and up to 1 year on refresh | In use |
| merofly_cookie_consent_v1 | Merofly | First party | Stores your cookie choices, the notice version and the date of your choice. | Strictly necessary | Up to 24 months | In use |
| merofly.ref | Merofly | First party | Remembers the invitation or partner code you arrived with so an order is attributed correctly. | Strictly necessary | Up to 30 days | In use |
| merofly_visitor / merofly.visitor | Merofly | First party | Optional visitor identifier used for referral-click and campaign attribution. Removed when you withdraw consent. | Advertising and marketing | Up to 30 days | In use |
| Checkout session storage | Stripe | Third party | Runs the secure payment form and Stripe's payment fraud checks during checkout. | Strictly necessary | Session, and up to 1 year for Stripe fraud prevention | In use |
| _ga, _ga_* | Google Analytics 4 | Third party | Measures page visits and journeys so we can improve the site. Loaded only after you allow analytics. | Analytics | Up to 24 months | In use |
| _gcl_au, Google Ads conversion tags | Google Ads | Third party | Advertising measurement and conversion attribution. | Advertising and marketing | Up to 90 days | Not active — proposed only |
| _fbp (Meta Pixel) | Meta | Third party | Advertising measurement and audience building. | Advertising and marketing | Up to 90 days | Not active — proposed only |
| _ttp (TikTok Pixel) | TikTok | Third party | Advertising measurement and audience building. | Advertising and marketing | Up to 13 months | Not active — proposed only |
Your consent record
When you choose, we store your category choices, the version of this notice you were shown and the date and time — nothing else. We do not attach extra personal identifiers to a consent record. It is kept for up to 24 months, or until you change it.
Changing or withdrawing
Use Cookie settings, available on every page and below, to change any category or withdraw consent. Withdrawing advertising consent also removes the optional visitor identifier from your browser.
Contact
Questions about cookies? Email privacy@merofly.com. See also the Privacy Policy.