Cookies and browser storage
Everything AdServeKit stores in a browser, why, and for how long. There is no advertising cookie, no third-party tracker and no cross-site identifier anywhere in this list.
If you use the dashboard
These are set on your own visit to AdServeKit. All of them are strictly necessary: without them you cannot sign in or stay signed in, so there is nothing here to consent to or refuse separately — declining them is the same as not using the product.
| Name | Kind | What it is for | How long |
|---|---|---|---|
houseads_session | Cookie | Keeps you signed in. HttpOnly, so no script can read it; SameSite=Lax, so it is not sent from another site's forms; Secure in production. | Until it expires or you sign out |
houseads_session_oauth | Cookie | Ties a Google sign-in to the browser that started it, so a finished sign-in link cannot be completed somewhere else. Scoped to the callback path and spent on use. | 10 minutes |
houseads.pending-team-invitation | Session storage | Remembers an invitation you opened before signing in, so it is still applied afterwards. | Until the tab closes |
houseads.pending-verification-email | Session storage | Remembers which address a verification email was sent to, so the page can offer to resend it. | Until the tab closes |
studio-colours | Local storage | Your recently used colours in the creative editor. A convenience; nothing is sent to the server. | Until you clear site data |
The CSRF protection on dashboard actions is not a cookie: it is a short-lived token bound to your session and sent as a request header. The two cookie names above are the defaults; an operator running their own deployment may configure a different prefix, in which case the names differ but the purposes and lifetimes do not.
If you are visiting a website that uses AdServeKit
A publisher may install our tag on their site to serve advertising and to measure their own traffic. It sets no cookies at all. It stores a small number of values in the browser’s own storage, which are readable only by that publisher’s site and are never shared between sites.
| Name | Kind | What it is for | How long |
|---|---|---|---|
houseads.visitor | Local storage | Tells a returning visitor from a new one. A random value created by your browser; it contains nothing about you. | Until you clear site data |
houseads.session | Session storage | Groups the pages of one visit together. | Until the tab closes |
houseads.analytics.visitor.*, houseads.sdk.visitor, houseads.landing.visitor | Local storage | The same purpose as above, for the site-measurement and landing-page variants of the tag. The suffix keeps one publisher's value separate from another's. | Until you clear site data |
houseads.analytics.session.*, houseads.sdk.session, houseads.landing.session | Session storage | The visit grouping for those same variants. | Until the tab closes |
houseads.sdk.click, houseads.landing.click | Session storage | Remembers which advertisement brought you to a landing page, so a conversion can be attributed to it. | Until the tab closes |
houseads.sdk.fired | Local storage | A short list of conversions already reported, so refreshing a confirmation page does not count a purchase twice. | Until you clear site data |
How to refuse it
Turn on Global Privacy Control or Do Not Track in your browser. The tag checks both before it stores anything: with either set, no identifier is created, nothing is written to your device to recognise you, and the visit is counted without one. The server checks the same signals independently, so it holds even if the page is stale.
Clearing site data in your browser removes everything above. Blocking the script entirely also works and costs the publisher a measurement, never you the page — the tag is loaded asynchronously and a page that cannot load it renders exactly as it otherwise would.
Related
What happens to the data after it reaches us — including how these identifiers are replaced with a keyed hash on arrival — is in the Privacy Policy. Publishers acting as data controllers should also read the Data Processing Addendum.